Security that covers more than the website itself
Attackers don't only go after your pages. A stolen domain login or a convincing fake email can do just as much damage, so we look at the whole picture.
What we look after
Your website
HTTPS, security headers, software and plugin updates, removing what is no longer used, and safer admin access.
Your forms
Server-side checks, spam protection and abuse limits, so forms stay easy for customers and hard for bots.
Your domain and DNS
Registrar and DNS account protection, records that limit who can issue certificates for you, and a review of old records.
Your email
SPF, DKIM and DMARC, introduced in stages, to make it harder for someone to send fake emails in your name.
Your accounts
Two-step sign-in on the domain, hosting and website accounts, and removing access nobody should still have.
Backups and recovery
Backups stored away from the site, a test restore, and written steps for what to do if something goes wrong.
Testing your site the way an attacker would
Penetration testing finds problems that a checklist misses. Because it is active testing, it follows clear rules.
- You approve the scope in writing before any active testing starts.
- Third-party systems, such as a booking or payment provider, are excluded unless that provider has also given permission.
- Testing is planned to avoid disrupting your customers.
- You get findings in plain English, ordered by what matters most to your business.
This site has to follow the same advice
You shouldn't have to take a security company's word for it. These independent tools can check this site right now:
Found something we missed? Please report it.
- Strict-Transport-Security
- max-age=86400
- Content-Security-Policy
- default-src 'none'; script-src 'self' https://challenges.cloudflare.com; style-src 'self'; img-src 'self'; font-src 'self'; frame-src https://challenges.cloudflare.com; connect-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'
- X-Content-Type-Options
- nosniff
- Referrer-Policy
- strict-origin-when-cross-origin
- Permissions-Policy
- camera=(), microphone=(), geolocation=(), payment=(), usb=()
- X-Frame-Options
- DENY
Start with what is publicly visible
Send us your address and we will check what is publicly visible: HTTPS, security headers, email protection and visible software versions. You get a plain-English summary. It is free and we never log in, scan or touch your site.
Ask for a free website check