Choose one audit or the discounted package
Website optimisation audit - 1 500 kr excl. VAT
A detailed review of performance, front-end code, technical SEO and accessibility. It also includes a baseline passive security check. Findings are ordered by risk and impact, with recommendations for further work.
Extended cybersecurity audit - 1 500 kr excl. VAT
An extended, non-invasive review of the website's publicly accessible surface and security configuration - without server login or attempts to bypass security controls. It covers agreed checks of TLS, security headers, cookies, CORS, forms, parameters, and public ports and services.
Combined audit package - 2 400 kr excl. VAT
A detailed optimisation audit and an extended cybersecurity audit ordered together. The regular price is 3 000 kr excl. VAT, so you save 600 kr. Remediation remains a separately quoted stage.
Performance and user experience
We investigate why the website loads slowly, responds late or behaves inconsistently. The analysis covers mobile and desktop, with separate measurements of selected representative pages when needed.
- Core Web Vitals and laboratory metrics: LCP, TBT, CLS and available INP data.
- Server response time, when the main content appears and render-blocking resources.
- Transfer size, network request count, compression and caching policy.
- Images, video, fonts, JavaScript and CSS - format, size, order and unused code.
- DOM complexity, layout stability and load on the browser's main thread.
Technical SEO, accessibility and code quality
The audit is not limited to a score from one tool. We combine measurements with a review of document structure, public URLs and elements that affect visibility, usability and maintainability.
- Page titles, meta descriptions, canonical, robots.txt, XML sitemap and structured JSON-LD data.
- Headings, semantic HTML, document language, validation and technical consistency.
- Alternative text, image dimensions, contrast, accessible names and baseline assistive-technology support.
- HTTP status codes, redirects, indexability and repeated metadata.
- Patterns that hinder development: excess CSS, unnecessary JavaScript, complex selectors and repeated code.
Within the detailed optimisation audit, we agree a specific sample before work begins. The report may, for example, cover up to 50 public URLs and separate measurements of up to three heavier or representative pages.
Cybersecurity audit: scope and safety boundaries
Checks are performed for the system owner or with confirmed authorisation. We agree the addresses and scope before starting.
- Passive HTTPS, TLS, headers, cookies and CORS review.
- Controlled input-reflection probe, without JavaScript execution.
- Non-destructive SQL error-signal probe, without boolean, time-based or data-reading tests.
- Limited TCP port list, without banner grabbing or login attempts.
- Checked addresses.
Clear boundaries
What a non-destructive security audit means
We do not perform brute force, modify or download data, establish persistent access or run code in a user's browser. A reflected parameter does not confirm XSS, an error message does not confirm SQL injection, and an open port is not automatically a vulnerability. Such observations are marked for manual verification.
What the optimisation audit report includes
- Executive summary.
- Mobile and desktop results.
- Separate measurements of selected pages.
- Security and TLS.
- Checks requiring action.
- Observations and potential improvements.
- Coverage and limitations.
- Technical checklist.
What the cybersecurity audit report includes
- Scope and safety boundaries.
- Review coverage.
- Discovered public entry points.
- Findings with recommendations.
- Control register with results and statuses.
The report distinguishes observations from confirmed issues. Input reflection alone does not prove XSS, a SQL error does not establish SQL injection, and an open port is not automatically a vulnerability.
Remediation and optimisation after the audit
Remediation is not included in the audit price. Once the system's condition is known, we select the issues to address and prepare an individual quote. We can improve agreed parts of the code, server configuration, front-end assets or page structure, then verify the result with another measurement.
If we cannot access the technology used, or the fix requires work by the hosting provider, ecommerce platform or a third-party plugin vendor, the report states who should take the next step.
Technical SEO in the audit, ongoing visibility in Google as a separate service
The audit covers technical elements that affect indexing and website quality: metadata, canonical, robots, sitemap, structured data, performance and semantics. Keyword strategy, content creation, link building and full SEO and AI search visibility remain separate services.
Accessibility and WCAG
Accessibility requirements depend on the market, service and business. Norway applies rules to private as well as public organisations; Polish consumer e-commerce rules include an exemption for services provided by microenterprises. Check Norwegian guidance and PFRON guidance for Poland.
We check agreed pages and flows for keyboard access, focus, contrast, form labels, alternative text and error messages. This technical review is not a certification of complete legal compliance.
Audit and code optimisation questions
How long does an audit take?
Normally 1 day after complete materials and scope have been agreed. We confirm the start and delivery dates when arranging the order.
Does the price include fixes and code optimisation?
No. The audit provides measurements and recommendations. Implementation, new functionality and remediation are quoted separately based on the report.
Do you need server access?
The cybersecurity audit reviews the public surface without logging into the server. Any code or configuration access needed for optimisation work is agreed separately.
Tell us about your project
Reply within 48 hours. Websites from NOK 9,750; audits from NOK 1,500 excl. VAT. Online stores are quoted individually.
You can also email office@2b.design.