What Changes on Your Websites Between Two Audits
Websites change between audits in seven common ways, from newly disclosed vulnerabilities to expiring certificates. The last audit report doesn’t change with them. It still says the site is in good shape until the next audit, which may be months or years away.
Code review rarely catches these changes either, because most involve no new code at all. Continuous checks close that gap, and audits stay the tool for judgment calls.
Key Takeaways
- An audit is a snapshot. Every change after the day it's done makes it less true.
- The most common change comes from outside the site: a newly disclosed vulnerability in its platform, a module or plugin, or PHP.
- Code review mainly looks at new code. Audits look more widely, but only at planned points that can be a year or more apart. Changes made in between can go unchecked.
- Audits still matter for migrations, baselines, and judgment calls, and continuous, automated checks close the gap between them. With critical vulnerabilities disclosed almost every week, teams need both.
Why Do Audits and Code Review Both Leave Gaps?
Both check a site at one moment. A full audit has to be scoped, scheduled, and carried out, and afterward the site may go a year or more without another look.
Code review mainly looks at the new feature or fix. It isn’t designed to recheck the rest of the site or notice a vulnerability published later.
Now multiply that by a portfolio. If you run hundreds of sites, by the time an audit reaches the last one, the first is already out of date. And the people accountable for the security and compliance of those sites are often not the ones making the changes.
Where a change comes from decides what will catch it
The changes fall into three groups.
Three groups of website changes, and the check each one needs
Group | Changes | What catches it |
|---|---|---|
Made outside the site | New vulnerabilities, versions falling out of support, expiring certificates and domains | Your site list matched against outside sources, continuously |
Shipped in a release | New code and the components it brings | A check after every release |
Made on the live site | Access, settings, scripts | Regular checks of each site and its connected systems |
What Changes on a Website Between Audits?
The seven most common are new vulnerabilities, releases, access, outdated versions, settings, scripts, and expiring certificates and domains. A continuous check is an automated test that compares every site with a written standard, on a schedule and after each release. Our guide to managing multiple websites without spreadsheets compares audits with continuous checks in more detail.
1. How Can a Site Become Vulnerable When Nothing on It Changed?
A site can become vulnerable overnight without any change: a flaw in code it already runs becomes public, and attackers learn about it too.
PHP2Shell is a recent example. On October 21, 2026, PHP released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let attackers take over PHP sites without logging in. On October 26, CISA added both to its Known Exploited Vulnerabilities catalog, meaning attacks were already happening. Our post on which websites a critical PHP flaw exposes covers the response.
On the day a flaw like this is announced, every team asks the same question. Which of our sites are affected? Without an up-to-date picture of what each site runs, finding the answer means checking every site one by one, and the time goes on searching rather than fixing.
Why an audit misses it: It checked each site against the flaws known on the day. It can't know about the ones published later.
What a continuous check does: When a flaw is announced, every team asks which of its sites are affected. A continuous check already knows what every site runs, so it can answer straight away instead of checking sites one by one. Pair it with security advisories, such as Drupal's Wednesday releases, because databases can take time to catch up.
2. What Can a Single Release Add to a Site?
When a developer adds one new library, it often brings in other code that it depends on.Code review gives those far less attention.
Why an audit misses it: It reviewed the list of components as it stood. Every release changes that list.
What a continuous check does: It rescans the code after every change and flags new risks, such as a vulnerable package, a license problem, or a package your organization doesn't allow.
3. Who Has Access That the Audit Never Saw?
Access grows and rarely shrinks. Someone gets admin rights for a campaign. A supplier is added to the hosting account. People leave, and their accounts stay open.
Why an audit misses it: It listed users on one day. Requests for access keep coming; removals don't keep up.
What a continuous check does: It counts admins against a limit you set, flags accounts nobody has used in months, and spots admins without multi-factor authentication (MFA) on the hosting account as well as the website.
4. Which Sites Are Falling Behind on Versions?
A site that was current a few months ago can be several versions behind, and once a version falls out of support, it stops getting security fixes.
Why an audit misses it: It recorded which versions each site ran at the time. Support dates and new releases arrive afterward.
What a continuous check does: It reads each site's platform, PHP, and hosting versions, and flags any that are behind or no longer supported, along with sites running outside your standard protection, such as a content delivery network (CDN) or web application firewall (WAF).
5. Which Settings Slip After a Fix?
Under pressure, people fix things directly on the live site. Someone opens public registration to test a form, or relaxes login protection while troubleshooting, and it never gets changed back.
Why an audit misses it: It confirmed the settings were right on the day. Changes made in a site's admin screens leave no ticket and no code change for anyone to review.
What a continuous check does: It checks each site's settings against your standard, including who can register, protection against password guessing, MFA for admins, and error messages hidden from visitors.
6. Who Added That Script, and Does Consent Still Cover It?
Marketing tools often reach sites through tag managers, not releases. A tracking pixel or chat widget can go live in minutes, with no developer involved.
Why an audit misses it: It approved the scripts and consent setup it found. A new tag that loads before visitors agree breaks that approval and may breach privacy rules where consent is required.
What a continuous check does: It shows which analytics and marketing tools are running on each site, so a new one doesn't go unnoticed and can be checked against your privacy standards.
7. Which Certificates and Domains Expire Before the Next Audit?
Certificates and domain registrations expire on fixed dates. A missed renewal shows visitors a security warning or takes the site offline.
Certificates are also getting shorter. Under CA/Browser Forum Ballot SC-081v3, public SSL/TLS certificates issued from March 15, 2026 last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029.
Why an audit misses it: Most certificates now renew automatically, so the real risk is a renewal that fails quietly between audits, or a domain a department bought that isn't on anyone's list.
What a continuous check does: It tracks days left on every certificate and domain, warns you well before the date, and checks that every site uses HTTPS.
What Does December 2026 Change About This Year's Audits?
The calendar alone can make a clean audit out of date. Drupal 10 reaches end of life on December 9, 2026, and PHP 8.2 stops getting security fixes on December 31, 2026. So a Drupal 10 site on PHP 8.2 that passed a spring audit starts January on two unsupported layers without an upgrade. Our Drupal 10 end-of-life decision calendar covers the options.
What Is a Website Audit Still For?
A website audit is still the right tool for decisions that need human judgment. Continuous checks show what has changed; people decide what it means.
A team in the middle of an upgrade might leave minor warnings alone, because the new version will remove them next month. Only the people who know the site can make that call. Audits are for:
- Migrations and redesigns. Checking the foundation before you build on it.
- Inherited sites. Getting an independent starting point.
- Setting the standard. Agreeing what "healthy" means, so continuous checks have something to measure against.
- Judgment calls. Whether a site still does its job for its audience, whether its technology will carry it forward, and which fixes are worth their cost. What a Vardot Drupal audit delivers covers that scope.
Continuous checks inform. People make the call.
What Can Your Team Set Up Now?
You can make a start on all seven with tools you already have. The first few need nothing more than a list of your sites.
A first step for each website change between audits
Change | First step |
|---|---|
Certificates and domains | Track every expiry date with early alerts, check that every site uses HTTPS, and automate renewal where you can. |
Versions | Record each site's platform and PHP version, and note when each one loses support. |
Scripts | Treat tag manager changes like any other change, and retest consent after each one. |
Access | Review website and hosting admins every month against a limit per site. |
Settings | Write down a few policies and check every site against them, for example, "every admin uses MFA" and "public registration stays off". Then add your own. |
New vulnerabilities | List each site's platform, modules, and versions, and subscribe to the matching security advisories. |
Releases | Run composer audit or npm audit as part of every release and keep the results. |
Where Does Auditray Fit?
Auditray, Vardot's agentic governance platform, runs continuous checks on every site for security, vulnerabilities, and compliance, and brings the results into one place. It works for one site or a thousand, on Drupal, WordPress, and other platforms. Our CEO explains why we built Auditray.
Here are some of the areas it covers.
- Vulnerabilities and code: Dependencies, vulnerabilities, exposed secrets, and license posture from GitHub, GitLab, or Bitbucket, with a software bill of materials (SBOM) export in CycloneDX or SPDX. When a new vulnerability is disclosed, it shows which sites may be affected.
- Access: User and role audits connected directly to Drupal, plus users with access to each hosting project.
- Infrastructure and versions: Each site's technology and hosting stack, PHP and runtime versions checked for security support, and CDN or WAF coverage against your requirements.
- Settings: Flags public registration where your policy doesn't allow it, checks that error reporting is hidden, and applies platform policies for WordPress and Drupal.
- Tags and scripts: Data from Google Analytics, Google Tag Manager, and Microsoft Clarity, showing which tools run on each site.
Certificates and domains: Checks for a valid SSL certificate, enforced HTTPS, and a domain that isn't about to expire.
Out-of-the-box policies cover these, and you can add your own, such as a package block list, with AI to help write them. A compliance matrix shows how every site measures up, and control history shows what was fixed, regressed, or introduced.
It also tells you what to fix first and which single fix clears the most issues, and sends the proposed fixes straight to your team’s task tracker.
Auditray monitors and reports. It doesn’t replace your developers or existing tools; it takes the hunt for problems off their plate.
How Can You Get Started?
Auditray already watches hundreds of websites for security, vulnerabilities, and compliance, and getting started is simple. Add a site's web address, and Auditray starts monitoring its health straight away, from its certificate and domain to the platform and version it runs. Connect more, such as its code or hosting, whenever you're ready, and the picture becomes fuller.
If keeping on top of your websites is a challenge, we'd love to hear from you. We work closely with organizations that run many sites to set up Auditray around their own standards and priorities, so it delivers real value from day one. We'd welcome the chance to do the same for you.