Website security and compliance audit for Adelaide small businesses
Most small business websites were built, launched and then left alone. Since then the privacy rules have tightened, website platforms are being attacked in bulk, and the government keeps asking small businesses to check their security. We look at your site, your domain and your email setup, and the rules your site already has to follow, and give you a short, plain list of what to fix.
Last updated
Website quick check $290 (ex GST), and the fee comes off any fix or rebuild you book with us within 60 days (not hosting). Full website security and compliance audit $890 (ex GST) for a typical small business site. Larger sites and online shops are quoted first, so call us and we'll work it out together. See all our prices
The short answer
No Australian law forces a small business to audit its website. Privacy, spam, consumer and disability discrimination laws already apply to what a website does, and the government's cyber security agencies recommend regular checks. WaTo Consulting in Adelaide offers a website quick check for $290 ex GST, covering security, domain, email, privacy policy and forms from the outside, and a full website security and compliance audit for $890 ex GST that also looks behind the login and includes a fixed quote for each fix.
Why check a website now
In July 2026 the Australian Cyber Security Centre warned of a large attack campaign against website platforms, mostly through WordPress plugins, and said many small and medium Australian businesses were already affected. The privacy regulator is now checking privacy policies and can issue infringement notices when required content is missing. From 10 December 2026, businesses covered by the Privacy Act must also explain in their privacy policy any significant decisions software makes about people. None of this means the government requires an audit. It does mean an untouched website is more likely to have a problem you'd want to know about first.
What we check
Security
The padlock certificate, security settings the site sends to browsers, the platform and plugin versions, and whether the login page is exposed to anyone who looks.
Domain and hosting
Who owns the domain, when it expires, whether it is locked, and whether the registrar and hosting logins have multi-factor sign-in turned on.
Email protection
SPF, DKIM and DMARC records, so scammers find it harder to send fake invoices that look like they came from you.
Privacy policy
Whether there is one, whether it is easy to find, and whether it covers the basics: what you collect, why, who you share it with and how people can complain.
Forms and tracking
What your forms collect, where the answers end up and how long they're kept, and which tracking tags fire on the page, such as Google, Meta or TikTok, and whether your privacy policy mentions them.
Rules the site already follows
Newsletter sign-ups and unsubscribe under the Spam Act, how prices are shown, and a quick accessibility check against the WCAG guidelines the Human Rights Commission points to.
Backups and updates
In the full audit we log in and check updates are being done, backups run and are kept away from the site, and old admin accounts are removed.
Speed and search basics
Mobile speed, broken links and the basic settings Google needs to show your pages properly.
Who it's for
- Small businesses whose website hasn't been looked at since it was built.
- Health, legal, accounting and real estate businesses, which the Privacy Act can cover whatever their size.
- Businesses with online forms, bookings, quotes or a chatbot on the site.
- Anyone filling in a cyber insurance form who wants a straight answer about the website.
- Owners who aren't sure who controls their domain or hosting anymore.
How it works
- You give us written permission. We only check sites you own or are authorised to have checked. For the full audit you also give us access to the site admin and hosting.
- We run the checks. The quick check is done from the outside, the way anyone on the internet sees your site. The full audit also looks behind the login.
- You get a scorecard. Each item is red, amber or green with a plain sentence on what it means. The full audit comes with a written report and a fixed price for each fix.
- We walk you through it. A 20-minute call for the quick check, 45 minutes for the full audit. You decide what to fix, who fixes it and when.
Why WaTo for a website check
- We build, host and repair websites every week, so the fixes we recommend are ones we know how to do.
- We check the website, the domain and the email setup together. Many website audits on offer are about search rankings.
- We start from the government's own advice, including the ASD guide to securing your website and the privacy regulator's guidance.
- The price is fixed and published. The quick check fee comes off any fix or rebuild you book with us within 60 days.
- The report is yours. You can use it with any web developer.
Website audit questions
Does the government require small businesses to audit their websites?
No. No Australian law makes a small business audit or check its website. What does apply is the law about what the site does: the Privacy Act for businesses it covers, the Spam Act for sign-ups and marketing email, consumer law for prices and claims, and disability discrimination law. The government's cyber security agencies recommend checking your website regularly, and offer free guides and a free Cyber Health Check to start with.
What's the difference between the quick check and the full audit?
The quick check looks at your site from the outside and gives you a one-page scorecard and a 20-minute call. The full audit also logs in to the site and hosting, checks updates, backups and admin accounts, looks at where form answers are stored, and gives you a written report with a fixed price for each fix.
How much does a website security audit cost?
Our website quick check is $290 ex GST and the full website security and compliance audit is $890 ex GST for a typical small business site. Online shops, membership sites and very large sites are quoted first. The quick check fee comes off any fix or rebuild you book with us within 60 days (not hosting).
Is this legal advice?
No. We tell you where the website looks like it falls short of the privacy, spam, consumer and accessibility rules, and why. If your business needs a legal view, for example on whether the Privacy Act covers you, we'll say so and you can take the report to your lawyer.
Will you try to hack my site?
No. That's a penetration test, which is a separate job with its own written authorisation. We look at how things are set up, not whether we can break in.
Can you check my competitor's site, or a site I'm thinking of buying?
Only with the owner's written permission. Checking someone else's systems without it can break the law, so we don't do it.
My site is on WordPress. Is that a problem?
No. WordPress is safe when it's kept up to date, and we look after plenty of WordPress sites. Most of the software named in the Australian Cyber Security Centre's July 2026 website alert was out-of-date WordPress plugins, so we check what's installed and whether updates are being done. If the site needs work, we'll explain the options, including keeping it on WordPress with regular care, and what each would cost.
We run an online shop. Do you check the checkout?
Yes, from the outside in the quick check and in more detail in the full audit. Since 1 April 2025, shops using an embedded payment form and the simplest card self-assessment (SAQ A) must confirm their site is not open to script attacks that could affect checkout. We check what runs on your checkout pages and whether your payment provider confirms its form covers this.
We use a chatbot or an online quote tool. Does that matter?
It might. From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy any significant decisions made by software using personal information. We list the tools on your site that could fall under this, so you can update the policy in time.
Related services
Guides on this topic
- The privacy policy change coming on 10 December 2026
- Website maintenance checklist for small business
- How to secure your business domain name
- My WordPress site has been hacked. What do I do first?
Sources & references
- Australian Signals Directorate: Secure your website
- Australian Cyber Security Centre: Large-scale exploitation campaign targeting website content management systems (July 2026)
- Australian Signals Directorate: Small business cyber security handbook, protecting business and customer data (October 2026)
- OAIC: APP Guidelines, Chapter 1, open and transparent management of personal information
- OAIC: Tracking pixels and privacy obligations
- Australian Human Rights Commission: Guidelines on equal access to digital goods and services
- PCI Security Standards Council: FAQ clarifies new SAQ A eligibility criteria for e-commerce merchants (February 2025)
Want to know where your website stands?
Tell us your web address and what the site does, and we'll book a quick check or quote the full audit, at a fixed price up front.
Mon to Fri, 8:30am to 5pm
