Website Audit Before a Rebuild: What to Check After a Security Alert

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Its advisory urges immediate updating and directs users to vendors for appropriate packages or backported fixes. Being affected by a vulnerability does not establish that a website was compromised. The first task is to confirm the status of your own environment with the hosting provider or system administrator.

For a business already questioning its website, the alert may also bring a larger decision forward. Should the company keep improving what it has, rebuild it or move to another platform? I would begin that discussion with a record of what the current website helps customers do, where it gets in their way and what the business still needs to verify.

The short answer: Before approving a rebuild, audit discoverability, the clarity of your offer, supporting proof and the customer journeys that matter. Separate observations from assumptions. Identify what to preserve, what to improve and what requires further verification, then turn those findings into requirements with an owner and a way to check the outcome.

What should you audit before rebuilding a website?

Start with the actions the website must support. A B2B company might need a prospect to understand a specialist service, examine relevant work and arrange a conversation. A product business might need customers to find the right item, compare specifications and complete an order. The assessment should follow those journeys.

Choose representative entry pages and destinations: the homepage, priority service or product pages, useful editorial content, proof pages and the main enquiry or purchase path. Record the review date, device, pages inspected and available sources. A sample can reveal useful problems, but the report should make its coverage clear.

Bring public observations together with information the business controls. Search Console, analytics, enquiry records, customer feedback and interviews with the people maintaining the site can answer different questions. Public page content can show whether an offer is clear; it cannot establish how much revenue a page generates or how long an internal approval takes.

The useful output is a set of decisions. Which content helps customers? Which observed problems need attention now? What must a replacement support? A brief becomes easier to evaluate when every proposed change answers a specific requirement.

What needs security confirmation before the wider review?

Ask the responsible provider which PHP installations were assessed, what security fixes were applied and whether there are signs that require investigation. The UK National Cyber Security Centre’s PHP guidance addresses identifying affected installations, remediation and assessing possible compromise. Work on a future website does not resolve exposure in an existing environment.

Where an incident has occurred, recovery needs its own verification. NIST’s incident-response guidance includes checking restored assets, working with system owners to confirm restoration and monitoring restored systems. A public website review cannot substitute for that work.

The Brand Health Audit examines available evidence about a business’s public presence. Its technical implementation methodology excludes penetration testing and private backend source-code review. Use the result to inform website improvements; keep security confirmation with the responsible technical team.

Record unresolved security questions separately, with a named owner. That helps a leadership team distinguish the status of the current environment from the merits of a longer-term website project.

Can customers find the right pages and get clear answers?

Assess discovery and comprehension together. A page needs a clear purpose: the service or product it explains, who it is for and the next useful action. Review its title, main heading, content and links as parts of that purpose. A technically accessible page can still leave a prospective customer uncertain about what the business offers.

Use owner-authorized Search Console data to understand which pages and queries are contributing visibility. Compare relevant periods and note changes in campaigns, demand, measurement or page availability before attributing a decline to the security alert. A change in traffic is a question to investigate, not a diagnosis by itself.

If Google has reported a security issue, review it with the appropriate team. Google explains that its Security Issues report provides findings and sample affected URLs; the examples may be incomplete. A report showing no issues should be described as Google’s reported status on the review date, not proof that every system is secure.

For answer-oriented content, put a useful answer near the question it addresses. Explain services in concrete language, identify the author and link to supporting evidence. Google’s AI optimization guidance says established SEO practices remain relevant and that no special AI schema is required. Clear writing helps a reader assess the information; it does not guarantee selection by an answer engine.

Turn a vague observation such as “our AEO needs work” into a requirement: “Each priority service page must explain the service, intended customer, process and next step in accessible text, with relevant supporting evidence.” That is something an editor, designer and developer can work toward.

Does the website earn trust and support the customer journey?

Review important claims alongside their evidence. If a page promises experience in a particular sector, can the reader find relevant work or a useful explanation of that experience? If a prospect needs reassurance before submitting an enquiry, is the necessary information close enough to help them decide?

Check company details, service descriptions, contact routes and the way proof is presented across important pages. Current, specific information gives the team a better foundation for a rebuild than a collection of broad statements about quality. Record missing evidence as a content requirement rather than filling the gap with stronger claims.

Then follow the main journey on mobile and desktop. Can a person reach the right page, understand the action, use the form and recover from an error? A short manual review should include keyboard interaction and clear field labels. W3C’s introductory accessibility checks are a useful starting point, while W3C explicitly cautions that those checks are not a comprehensive evaluation.

Separate visible behaviour from delivery. A form’s success message does not confirm that a lead reached the CRM, was assigned correctly or received a response. Those questions require an authorized test and confirmation from the relevant system or team. Describe what was checked and what remains open.

The audit’s website-experience review and conversion and customer-journey category provide useful context for these assessments. The latter reviews the offered journey; it does not, by itself, establish the business’s actual conversion rate.

What should you preserve, improve and verify?

A rebuild brief should protect useful work as well as describe improvements. Organize findings into three groups: preserve what has demonstrated value, improve an observed weakness and verify an unresolved question.

The following examples are illustrative. They are not findings from a client audit or statistics about website performance.

Illustrative observation	Decision	Requirement or next check
Owner-provided enquiry data shows that a service page contributes qualified leads.	Preserve	Account for the page’s useful content and URL when planning the replacement.
A primary enquiry button leads to a missing page.	Improve	Repair the destination and retest the journey. An urgent repair need not wait for a rebuild.
A form displays success, but delivery has not been tested.	Verify	Arrange an authorized submission and confirm receipt and routing with the responsible team.
An audit cannot access an important page.	Verify	Record the coverage gap, establish the reason and inspect the page before judging its quality.

For every finding, retain the page URL, date, observation, evidence and confidence in the conclusion. Add an owner and a clear retest. “The button returned a missing-page response on this date” is more actionable than “the website has poor UX.”

Keep missing evidence separate from poor performance. As our guide to data coverage versus performance explains, an inaccessible source is an assessment gap. It should not automatically become a negative quality finding.

Use business impact to set priorities. A blocked enquiry route may deserve immediate attention even when other parts of a report look healthy. An overall score can help organize a conversation, but the decision still needs the underlying evidence.

How do you turn audit findings into a website brief?

Write requirements as observable outcomes. “Modernize the website” leaves room for several interpretations. “A marketing editor can update a service page using approved components, and a submitted enquiry reaches the correct team” gives the project something concrete to design and verify.

For each requirement, specify the business purpose, source evidence, responsible person and acceptance check. Include constraints supplied by the team: content volume, localization, integrations, approval needs and capabilities the business must retain. Mark assumptions that still need a technical discovery session.

A platform review then has a clearer starting point. Webflow may be a suitable option for a marketing website when its capabilities fit the agreed content, publishing and integration needs. Our enterprise comparison of Webflow and WordPress examines that choice in more depth. The brief should make the reasons for the decision visible.

In my Agency Review Guide guest article on the PHP security crisis, I discuss the responsibility that comes with a website’s operating model. An audit makes that discussion more concrete by documenting what the business needs and where additional evidence is required.

Where should you start with a Brand Health Audit?

Start with the questions you need answered and choose an assessment that covers them. The Branded Agency’s free overview currently covers brand strategy and messaging, SEO visibility, AEO and GEO. Website technical health and conversion/journey categories are included in paid plans; the current scope and plans explain the distinction.

Read how the audit works to understand its evidence sources, coverage and confidence. Bring the findings into a review with the people responsible for content, design, development and marketing operations. Add the private business information and authorized tests that a public assessment cannot supply.

The result should be a clearer decision about the work the website needs, with requirements that a team can implement and check. A business may choose immediate improvements, a different maintenance arrangement or a rebuild. The evidence should make that choice easier to explain.

Start a free Brand Health Audit or see an illustrative sample report before you begin.

Frequently asked questions

Should you audit a website before redesigning it?

Yes. A focused audit helps identify what the current website contributes, where customers encounter problems and which requirements a redesign should meet. Combine public observations with business data and staff input. Document valuable content and journeys as well as weaknesses so the brief preserves useful work.

Can a public website audit tell whether a site was hacked?

A public website audit cannot establish whether a server was compromised or whether all required fixes were applied. It may identify visible issues that need investigation. Ask the hosting provider or qualified security team to assess the environment and confirm remediation for the systems your business operates.

What should you preserve when rebuilding a website?

Preserve the useful content, journeys and functionality supported by evidence of customer or business value. Record important URLs, content relationships and integrations before implementation. The migration plan should then define how each item will be retained, improved or deliberately retired.

Does a security alert mean a business should move to Webflow?

A security alert is a reason to review responsibilities and requirements. A platform decision should also consider content needs, integrations, publishing workflows, costs and the team’s capacity to maintain the website. Webflow deserves evaluation when it fits those needs; the current environment still requires appropriate remediation during planning.

Does the free Brand Health Audit include every check in this guide?

No. The free overview covers four public-data categories: brand strategy and messaging, SEO, AEO and GEO. Technical-health and conversion/journey categories require a paid plan. This guide also recommends owner-supplied business evidence and authorized manual checks that extend beyond an automated public scan.

Sources and further reading

Quincy Samycia’s founder perspective on the PHP security crisis and brand resilience.

PHP official security announcements — Primary release and remediation information.

UK National Cyber Security Centre PHP alert — Guidance for assessing and responding to affected environments.

NIST SP 800-61 Revision 3 — Incident-response and recovery guidance.

Google Search Console Security Issues report — The scope and limitations of Google’s reported findings.

W3C Easy Checks for Web Accessibility — Introductory accessibility review.

Google AI optimization guide — Official guidance on Google’s generative AI search experiences.

Agency Review Guide guest perspective — Quincy Samycia on website ownership and platform decisions.

About the author: Quincy Samycia is Co-Founder and CEO of The Branded Agency. He writes about brand strategy, website decisions and growth.

Disclosure: The Branded Agency operates the Brand Health Audit and provides website design and development services. Agency Review Guide is also owned and operated by The Branded Agency Inc.; the linked guest essay is an affiliated perspective.