Every check, in plain English
Your policies — we actually read them
Does the Privacy Act even apply to you?Most small businesses under $3m turnover aren't covered by it — but childcare, allied health and several other industries are, whatever their size. We tell you where you actually stand, instead of assuming the answer that sells more.
Privacy policy depth — the elements we checkWe open your policy and name what's missing: overseas disclosure, how to make a complaint, what you collect, how it's stored, when it was last updated. Almost nothing else on the market reads the inside of the document.
Refund wording checked against the Australian Consumer LawBlanket "no refunds" can be unlawful and the ACCC enforces it. We read your terms and flag the exact wording.
Privacy Policy presentRequired the moment you collect a name or an email address.
Terms & Conditions presentThe contract behind every sale you make.
Returns & refund policy presentWhat the Australian Consumer Law expects if you sell anything.
Shipping & delivery policyDo customers know delivery times and costs before they pay?
Can customers trust you're real?
ABN & business identityCan people check you're a genuine registered business?
Contact details visibleCan customers actually reach you — phone, email, or contact page?
Business address / locationCan they see where you're based?
Spam Act consent (pre-ticked boxes)A pre-ticked sign-up box isn't valid consent — it can make your whole mailing list unlawfully collected.
Can someone pretend to be you?
Email spoofing protection — SPF, DKIM & DMARCCan scammers send emails pretending to be you? This is what stops fake invoices reaching your customers.
Duplicate SPF / DMARC recordsThe mistake almost nobody checks: publish two records instead of one and your protection is silently switched off completely. You look protected. You aren't.
Registrar transfer lockCould someone steal your domain name? A free setting most businesses have never turned on.
DNSSECCould someone forge your web address and redirect your customers to a fake site?
Domain expiryAn expired domain takes your website and your email offline — and anyone can then buy it.Note: we cannot perform this check on .au domains. auDA deliberately withholds expiry dates from the registry (scrapers were using them to send fake renewal notices), so no tool can look it up — ours included. We say so in your report, and show you how to check it yourself in two minutes.
Is your site safe for visitors?
SSL certificate & HTTPSDoes your site show the padlock — or does the browser say "Not secure"?
Security headers (5 checked)The browser protections that stop attackers hijacking your pages or injecting code into them.
Malware & phishing blacklistHas Google flagged your site as dangerous? If so, most visitors never get past the red warning screen.
Known software vulnerabilities (WordPress core, themes & plugins)Is your website software out of date and known to be hackable? Checked against a live vulnerability feed.
Cross-origin (CORS) exposureCan any other website quietly make logged-in requests to yours and read the answers? A common misconfiguration that can leak customer data sideways.
Exposed usernames (WordPress)Is your list of login names public? That hands an attacker the hardest half of breaking in — they only have to guess the password.
Payment handlingDoes your checkout keep card details off your own servers?
Who's watching your visitors?
Tracker detectionWhich analytics and advertising tools are running on your site — named, not just counted.
Tracking disclosed in your privacy policyThe OAIC's 2026 determinations found that running a pixel without naming it in your privacy policy breaches the Privacy Principles. We check your policy actually discloses what's running.
Cookie consent noticeAre visitors told about tracking before it starts?
Region-aware consent rules (EU / UK)Sell overseas and you're under their cookie law too. We apply it if you tell us you have customers there.
Does your site actually work?
Broken linksDead links sending your customers to error pages. We crawl your site and test them.
Mobile-friendlinessDoes your site work properly on a phone — where most of your customers are?
Content freshnessDoes your site still look current, or is it quietly showing its age?
Placeholder & template contentUnrenamed builder templates or filler text that make a site look half-built.
And in your report
Your AI Readiness score — how ready your site is for AI to find youSix on-page signals AI assistants like ChatGPT and Perplexity use to discover and understand your business. As more customers find businesses through AI, it's one more blind spot we help you catch — shown for your awareness, it doesn't affect your score.
Every issue named — what, where and whyNot "missing Content-Security-Policy header" and good luck. Plain English, every time.
Step-by-step fix for anything critical — freeWe won't leave a small business sitting on a serious problem because they bought the cheaper report.
Anything we couldn't check, we tell you"Not tested" is a real answer. We never pass a blind spot off as a pass — and we still explain what the check is, why it matters, and how to confirm it yourself.
Free re-scans for 90 daysFix something, re-scan, and we'll confirm it's actually gone. As often as you need, for 90 days.
Accuracy guarantee. In addition to your rights under the Australian Consumer Law.
Refund policy. Choose Essentials now and upgrade later: move up to Expert within 30 days and pay only the $200 difference.