Umbraco Security Review

Most Umbraco websites we look at aren't compromised by anything clever. They're on an unsupported version, the back office login is sat on the public internet, an API is giving away more than anyone realised, or a package nobody has updated in years has a known vulnerability. None of it shows up in your analytics - it shows up when it's too late.

An Umbraco Security Review is a structured examination of your website's configuration, code and dependencies, by a team that has worked exclusively with Umbraco since 2013. You get a prioritised report of what's wrong, how serious it is, and what it takes to fix.

A written report both your developers and whoever signs the invoice can use: every finding with a severity, a plain-English explanation of the real risk, and a specific fix, ordered by priority. You also get a fixed quote for the remediation work - which you're free to hand to anyone.

A review, not an attack. We inspect, read and analyse - we don't exploit anything and we don't run attack tooling. There's no operational risk, no maintenance window, and nothing touches your website that an ordinary visitor wouldn't.

Not an accredited penetration test. Nevitech isn't CREST or CHECK accredited. If you need a pen test for ISO 27001, PCI DSS or a supplier questionnaire that names an accreditation, you need a specialist firm - and we'll tell you that rather than sell you the wrong thing. Most schemes also require a tester who's independent of whoever built the website, so if we built yours, we can't be that party. What this review does is find the things that actually compromise Umbraco websites, using platform knowledge a general security firm doesn't have.

• Businesses on Umbraco who've never had the website reviewed for security.

• Agencies wanting an independent Umbraco specialist to check a build before or after handover.

• Anyone who's inherited an Umbraco website and wants to know what they've taken on.

• Anyone on Umbraco 13 (end of life 14 December 2026) or an already-unsupported version.

• Anyone facing a client security questionnaire they can't honestly complete.

1. Scoping call - 30 minutes to understand the website, the hosting and what you need. No charge.

2. Authorisation and access - you confirm in writing you can commission the review; we agree the scope and get read access to the code and a redacted copy of the configuration (secrets removed, no production database needed). For sensitive data, the analysis can run entirely on Nevitech systems.

3. The review - typically one to two weeks, depending on the size of the solution.

4. Report and walkthrough - the report, plus a call to talk through the findings and priorities.

We price the review after the scoping call, once we know the size of your solution. Larger solutions, Umbraco Commerce installations and multi-site setups are quoted individually. For clients on a Nevitech retainer, the review can run within your existing hours - usually once a year, or after any significant change.

We've worked with Umbraco and nothing else since 2013, across every version from 7 to 17, on premises and on Umbraco Cloud. Every developer here is an Umbraco Certified Master, we're an Umbraco Silver Partner, and our founder Justin Neville is an Umbraco MVP 2026 and an Umbraco CMS core contributor. Umbraco security problems are usually Umbraco problems - knowing which configuration flags to check and how the Delivery API behaves is the difference between generic findings and a report you can act on. We carry professional indemnity, public liability and employers' liability insurance (certificates on request), and we practise what we preach - see our approach to security.

Book a scoping call - it costs nothing, and you'll get a straight answer on whether a review is worth doing.