Agency audit outline

StackRefit Audit Outline

White-label audits for legacy PHP/Linux systems your agency did not build. Before your agency quotes changes, upgrades, takeover work, or long-term support, StackRefit helps you understand what the client actually has.

When agencies use this

Use the audit before quoting risk.

The audit gives your agency a clearer basis for scoping, pricing, risk communication, and next-step recommendations.

01

"The old system works, but we need changes."

02

"The original developer is gone."

03

"PHP needs upgrading, but nobody knows what will break."

04

"The WooCommerce site makes money, but the stack feels fragile."

05

"We need to take this over, but there is no documentation."

06

"The client wants AI features, but the foundation may not be stable yet."

Audit questions

What the audit answers.

QuestionWhat the audit clarifies
What runs where?Application, CMS/framework, database, hosting, server, integrations, and deployment path.
What is outdated or unsupported?PHP, database, framework, CMS, plugins, packages, server OS, and relevant dependencies.
What could break if we change it?Upgrade blockers, compatibility risks, brittle areas, manual processes, and undocumented assumptions.
Are backups useful?Backup presence, location, retention, ownership, and whether restore has been tested or documented.
Can we deploy safely?Staging status, version control, CI/CD, manual deploy steps, rollback options, and operational gaps.
What should happen first?30/60/90-day modernization roadmap ordered by risk, effort, and business impact.
Deliverables

A practical report, not a rewrite pitch.

The goal is to make the system understandable enough to discuss risk, quote responsibly, and modernize without immediately forcing a rebuild.

Packages

Audit packages.

GBP pricing can be quoted for UK agencies at proposal stage.

PackageBest forTypical scopeStarting price
StackRefit Audit LiteSmall WordPress or PHP sitesOne application, basic hosting review, short risk summaryFrom €750
StackRefit Agency AuditTypical inherited agency client systemsApplication, CMS/framework, hosting, backups, deploy path, roadmap, white-label summaryFrom €1,250
StackRefit Audit PlusLarger WooCommerce, Laravel, custom PHP, or VPS-heavy systemsDeeper infrastructure review, integrations, more complex roadmap, implementation optionsQuoted after scoping
Boundaries

What is not included.

A StackRefit Audit is intentionally bounded. Production changes, upgrade work, stabilization, and implementation are scoped separately after the audit.

The audit is not a penetration test, compliance certification, unlimited debugging engagement, emergency incident-response retainer, production-change package, or unrestricted AI processing approval.

White-label use

Your client sees a calm plan.

StackRefit can remain invisible to the end client, appear as a named specialist partner, or support your team during a client review call depending on the relationship and scope.

Support your agency's takeover recommendation.

Quote legacy work with fewer unknowns.

Give the client a calm explanation of technical risk.

Create a roadmap before asking for larger modernization work.

Reduce pressure on senior developers when the system is outside your usual comfort zone.

Preserve the agency relationship while using specialist legacy-stack depth.

Process

How the audit runs.

01

Initial scoping

Clarify system type, business context, deadline pressure, known risks, and whether the audit is white-label, agency-branded, or direct.

02

Access checklist

Collect repository, CMS/admin, hosting, SSH, database, backups, deployment notes, and contacts with read-only access preferred.

03

Technical review

Review the agreed system surfaces without making production changes.

04

Report delivery

Deliver concise findings, assumptions, risks, and recommended next steps.

05

Review options

Join a review call, prepare a stabilization proposal, or help turn the roadmap into phases if useful.

Client-forwardable paragraph

Before quoting changes to the existing system, we are arranging a technical audit of the current stack. The purpose is to understand what runs where, which versions and dependencies create risk, how backups and deployment currently work, and what should be addressed first. This helps us avoid guessing, reduce production risk, and recommend a practical modernization path instead of pushing unnecessary rebuild work.

FAQ

Frequently asked questions.

How long does an audit take?

Most audits take 3-7 business days after access and scope are confirmed. Larger or more fragmented systems may need longer.

Do you need production access?

Not always. Repository access, CMS/admin access, hosting notes, backup information, and staging are often enough for the first pass.

Will you make changes during the audit?

No production changes are made during the audit unless a separate written scope and approval process is agreed.

Can the audit be delivered under our agency brand?

Yes. The report can be prepared for internal agency use, as a white-label client-facing document, or as a named specialist report.

Is this only for broken systems?

No. The best time to audit is before a system breaks, before a risky upgrade, before a takeover, or before quoting a new phase of work.

Is this a rewrite pitch?

No. StackRefit starts from the assumption that old systems often contain valuable business logic.

Start with clarity before quoting risk.

Inherited systems are risky when nobody knows how they work, what they depend on, or how safely they can be changed.