Find out what a stranger can see about your website, then close it off.
Your website is open to everyone, which includes the people looking for a way in. We check what it gives away, fix the problems in a safe order without taking the site offline, and test it again with you so you can see every problem gone.
The problems we find
None of these needs a clever attacker. Each one is found by software that checks websites all day, and each one was put there by accident: a deadline, a plugin, a developer who left.
- A password or secret key sits in the code every visitor downloads, where scanners find it within hours.
- The site sends no useful rules about what code a page may run, so anything slipped onto a page runs in your visitors’ browsers.
- Visitors can land on the unprotected version of the site, and what they type can be read on the way.
- Login cookies are not locked down, so a copied cookie means someone else is signed in as your customer or your staff.
- WordPress, or a code library inside it, is years out of date, with weaknesses that were made public long ago.
- Anyone can list your staff usernames, which hands attackers half of every login.
- The original, readable source code of the site is published for anyone to download.
Start with the free website security scanner. It takes about ten seconds, needs no signup, and shows you the problems it can see from outside. It is the same tool we use to check our own work at the end. If it comes back clean, we will tell you so.
What we check
The scanner reads what any visitor’s browser receives. A review goes further, and covers three areas.
The connection. Whether the site works over a protected connection, whether visitors who start on the unprotected address are moved across, and whether browsers are told to insist on it. Without these, what your visitors type can be read on the way.
What the site tells browsers to do. Every site can give browsers rules: what code a page may run, whether it can be shown inside another site, how cookies are treated. Many sites have some of these and not the ones that matter. We read what each rule actually says, because a rule that is present but says nothing useful gives a false feeling of safety.
What the site gives away. Keys and passwords left in the code every visitor downloads, the original source code published for anyone to read, the version of the software you run, and on WordPress the list of people who can log in.
How we fix it, without taking the site offline
The order matters more than the speed. Some changes affect every visitor, and a change that is right on paper can still stop a form or a payment working. So we make one change at a time, try it where a mistake does no harm, check it, and only then move on. The work is written down as it happens, so you are never dependent on us to understand your own site.
If we find something that may already be in someone else’s hands, such as a secret key in your page code, that comes first and is handled as exposed, not as a tidy-up.
What it costs
A fixed fee, agreed after a security review and before any work starts. Never by the hour. How much depends on the size of the site, how much custom code and how many plugins it carries, and what we find. See pricing for how we quote.
What you receive
- A check of your site from the outside, the way a stranger sees it, including the things the free scanner cannot judge on its own.
- A written list of what is wrong, ranked by what to do first, in language you can forward to your board or your insurer.
- The problems fixed in a safe order, each change tested before the next one starts.
- Anything that has been exposed treated as exposed, and replaced, rather than quietly hoped about.
- A record of every change we made, so nothing is a mystery to the next person who looks after the site.
- A second check at the end, run with you, so you can see every problem gone.
How the engagement runs
- 1
Look at the site from the outside
We start where an attacker starts, with only what any visitor can see. We read what the site sends, what its pages load and what it gives away. We add the checks a free tool cannot judge, such as whether a particular setting is protecting you or just present.
- 2
Rank the findings
You get a short list in plain English, ordered by what to deal with first. Anything that could already be in someone else’s hands goes to the top.
- 3
Agree the scope and a fixed fee
After the security review we quote a fixed fee for the work. You know the cost before we start, and it does not grow if the work runs long.
- 4
Fix in stages, without taking the site offline
Each change is made on its own and tested before the next. Anything that could affect your visitors is tried in a safe way first, so a mistake is caught by us and not by your customers.
- 5
Document and test again
You get a record of what changed and why. Then we run the check again together, so the before and after are in front of you.
What changes afterwards
The problems the free scanner showed you are gone, and you have a written record to prove it. Someone who looks at your site from the outside finds a closed door instead of an open one. You can answer a client’s or an insurer’s security questions truthfully and in writing. And whoever looks after the site next has a record to work from.
Frequently asked questions
Is this the same as the free website scanner?
The scanner is where it starts. It reads your site the way a visitor’s browser does and shows you the problems. The service is the part the scanner cannot do: judging what matters for your business, fixing it safely and proving it is fixed.
Will fixing this break my site?
That is the risk we are paid to manage, and it is why we change one thing at a time and test each change before the next. Your site stays online throughout.
We use WordPress. Is that a problem?
WordPress itself is not the problem. Out-of-date WordPress, plugins nobody maintains and open entry points are. Most of our work on WordPress sites is closing those.
Do you charge by the hour?
No. After a security review we quote a fixed fee for the scope we agree. Hourly billing rewards the slowest supplier.
What if you find nothing?
We tell you, and we do not invent work. A clean result is a good result, and we say so.
Will you tell me exactly what to change so I can do it myself?
We explain what is wrong and why it matters, and we hand your team everything they need to understand it. The engagement is for the doing, in the right order and with testing. If you would rather have your own web person do it, share the free scanner’s result with them.
Our promise, on every engagement
- Fixed scope, fixed fee, agreed before we start.
- Every change staged and tested, so your site never goes offline for our work.
- Full documentation handed over. No lock-in, ever.
- A second check at the end, run with you, so you can see the problems gone.
- If nothing needs fixing, we tell you, and we will not invent work.
See what a stranger can see about your website.
Run the free scanner, or book a security review and we will walk through what it found, what that allows someone to do today, and what fixing it involves at a fixed fee.