Skip to content
Shahid Malla

Fixed-price packages · from $199

Security Testing and Audits

Defensive, authorized security testing for small businesses, hosting companies and SaaS founders: website and API penetration tests, WordPress and Linux server audits, and security reviews of PHP, Laravel, WHMCS and AI-built code. Each job ends with a written report, severity ratings, fix steps and a retest. Fixed prices from $199.

Security Testing and Audits: 8 packages

What does a website penetration testing service include?

A penetration test is a person trying to break into your website or web app, within limits you sign off, and writing down how they got in. A scanner run is part of it, but the findings that hurt small businesses usually need a human: one customer reading another customer's invoices, a password reset link that never expires, an admin page that only hides its button. I test against the OWASP Top 10, use OWASP ASVS and the OWASP API Security Top 10 where they fit, and rate each finding with CVSS so you know what to fix first.

You get a written report with severity, proof (screenshots or the exact requests, never copied customer data), fix steps your developer can follow, and a retest once the fixes are in.

Which security test do you need?

You needStart withWhy
Proof your site or SaaS app holds up before a launch or a customer's security questionnaireWebsite and Web App Penetration TestLogins, roles, forms and access control tested by hand
A WordPress or WooCommerce site with many pluginsWordPress Security AuditPlugins, users, endpoints and settings checked
Custom or bought WHMCS addons and hooksWHMCS Custom Module Code Security ReviewThe module code read for injection, access checks and leaked keys
A WHMCS install you want protectedWHMCS Security Module Setup and HardeningMy own security module configured, plus admin 2FA and IP rules
A mobile app backend or public APIAPI Security TestingObject-level access, tokens and rate limits tested
A VPS, dedicated or cPanel/WHM serverLinux Server Security AuditSSH, firewall, services, patches and backups reviewed
A PHP or Laravel codebase you did not writePHP and Laravel Code Security ReviewSource-level review of injection, authorization and secrets
An app built with Lovable, Bolt, Replit, v0 or CursorSecurity Review for AI-Built AppsExposed keys, open tables and missing auth checks found

How do you keep the testing authorized and safe?

  • Before any test, the system owner signs a written authorization and the two of us agree a scope: targets, accounts, dates and hours.
  • You must own or control every target. Shared hosting, cloud and SaaS platforms have their own testing policies, and some need their permission first.
  • A staging copy is preferred. On production I keep request rates low and test in hours you choose.
  • No denial-of-service or load testing, no phishing or social engineering, and no systems you do not own.
  • Findings go to you only. I sign an NDA on request.

Can a security audit for small business support PCI DSS, SOC 2 or HIPAA work?

Yes, as evidence. A dated report with scope, method, findings and retest results is the kind of document assessors and enterprise customers ask for. It is not a compliance attestation, and whether you meet PCI DSS, SOC 2 or HIPAA is decided by your assessor or auditor, not by a test report.

What is not included in a fixed price?

Fixing the findings, unless the plan says it includes patches; your developer or I can do that as separate work. Cleaning a site that is already hacked is a separate job too, as is hands-on server hardening, which is covered on the server security hardening page. A full WHMCS settings audit or hack recovery belongs to the WHMCS security audit service, and rebuilding a broken AI-built app is vibe-coded app rescue. Paid tool licenses, cloud costs and module licenses are paid by you. No test can promise that a system will never be breached; it lowers the risk you know about.

How ordering a package works

  1. 1

    Choose a plan

    Pick Starter, Business or Premium and pay once by card, PayPal or crypto. The price on the page is the price.

  2. 2

    Send your content

    A project opens for your order. Send your text, logo, photos and any logins I need there.

  3. 3

    I build it

    I build on a private staging link you can open on your phone, with updates as I go.

  4. 4

    Launch and handover

    After your approval the site goes live on your domain, and every login is yours.

One-time price, no monthly fee from me

You pay for the build once. Your domain and hosting are registered in your name and renewed with your hosting provider, who bills you directly. I add nothing on top, and the site keeps running whether or not you hire me again.

What I do not build

Gambling and adult websites, and sites that sell content without the rights to it. Need something not listed? Ask for a custom quote.

Ordering from the US, Canada or Australia

Most of my clients are in the United States, Canada, the United Kingdom, Europe and Australia. Here is how an order works from those time zones.

Work happens while you sleep
I work from India. Your evening in New York, Toronto or Los Angeles, or your night in Sydney or Perth, is my working day, so each day's progress is waiting on your staging link when you start.
One price in US dollars
You pay the listed USD price by card, PayPal or crypto; your bank converts from CAD or AUD. My invoice from India carries no US sales tax, Canadian GST/HST or Australian GST. If your business has to self-assess tax on imported services, your accountant will tell you.
Payments your customers already use
Stripe, PayPal and Square work in all three countries. I connect the gateway you open in your own business name, so the money goes straight to you.
Hosting and domains in your country
Your site can sit in a US, Canadian or Australian data center, on a .com, .ca or .com.au domain registered in your name. Country domains have their own eligibility rules, which I check before you register.

More on hiring me from your country: United States · Canada · Australia · United Kingdom

Questions about security testing and audits

How do you handle our data and the findings?

Proof in the report is limited to what shows a flaw exists: a screenshot, a request and response, or a record ID, with personal details masked. I do not download customer databases. The report goes only to the contacts you name, I sign your NDA on request, and test accounts and working notes are deleted after the final retest.

Can you fix the issues as well as find them?

Some plans include patches or applied fixes, and each plan lists them. Otherwise every finding comes with fix steps written for your developer. If you have no developer, I can quote the fixes once the report is out, because the size of that work depends on what the test finds.

When should I book the retest?

Once your fixes are deployed to the environment I tested. Tell me which findings you fixed and I check each one again with the same requests I used to find it. The retest window is listed on each plan; findings that are still open stay in the updated report with their original severity.