No subscription and no monthly fee for a dashboard you'll never open. You buy one audit and you own it — then we stay with you while you actually fix things, with free re-scans for 90 days.
A full audit against 35 checks — compliance, security and AI readiness — with every issue named in plain English.
Everything in Essentials, plus 14 deeper security scans and a cybersecurity professional who reads your specific site.
The full Expert audit, a call to walk you through it, your policies sorted, and a professional checking your site every month.
That's the complete list — and here's what we don't check, which we think matters just as much. This is a website health check, not a penetration test, and we say so in every report.
Display it on your site if you'd like to. It links to a page anyone can check, and it refreshes on its own each time you re-scan.
Yours the moment your review lands, whatever it finds.
A score of 80 or above, with no critical issues outstanding.
The Expert deep scan run, with nothing left outstanding in it.
A badge is not a certification and not a guarantee. It records that an independent review happened on a date, and what that review found — nothing more. It stays current for 12 months, then it's re-earned from a fresh scan rather than renewed automatically. Displaying it is entirely optional, and you can turn it off at any time. How the badge works →
Most security reports get read once, feel alarming, and then sit in a folder. Not because owners don't care — but because nothing helps them get from "here's what's wrong" to "it's fixed." That gap is the part we stayed for. None of it costs you another cent, and none of it ties you to anything.
Fix something, click re-scan, and we'll confirm it's actually gone. As often as you need, for 90 days. You get a simple progress view: what you've fixed, what's still open.
If a rule changes, or a vulnerability turns up in software we saw running on your site, we may drop you a line — and if we do, we'll explain how to check and fix it yourself, in plain English. It's a courtesy from what we noticed at the time of your audit, not a monitoring service: we don't watch your site, we can't promise to catch everything, and keeping it up to date stays with you.
Redesigned the site? New plugin? Rule change? Come back for a fresh check at $147 (Essentials) or $397 (Expert) — because we already know your site and we don't have to find you again. Your code arrives before your free re-scans close, and it's good for two years.
Expert re-scans are automated progress checks, delivered in minutes — your original expert review stands with your first report.
Every tier runs the same accurate scan. What changes is how much you see — and whether we hand you the fix.
| What we check | Scorecard Free |
Essentials |
Expert |
|---|---|---|---|
| Compliance — we read your policies | |||
| Privacy policy depthWhich Privacy Act elements are missing | count | named | named + fix |
| Refund wording vs Australian Consumer LawBlanket “no refunds” flagged for review | count | named | named + fix |
| Terms, shipping policy, ABN & contact details | count | named | named + fix |
| Cookie consent, tracking & sign-up consentRegion-aware, plus Spam Act consent on your forms | count | named | named + fix |
| Security | |||
| Email spoofing — SPF, DKIM, DMARC | count | named | + setup steps |
| Duplicate SPF/DMARC recordsSilently switches your protection off | count | named | named + fix |
| SSL, security headers, malware blacklist | count | named | named + fix |
| Software vulnerabilities (WordPress/CVE) | count | named | named + fix |
| Public exposure — CORS & exposed usernamesCommon misconfigurations that leak data or aid break-ins | — | named | named + fix |
| Domain security — expiry, transfer-lock, DNSSEC | — | named | named + fix |
| Does your site work — and look current? | |||
| Mobile-friendly, broken links & content freshnessWhether your site works for visitors and doesn't look out of date | count | named | named + fix |
| Placeholder & template contentUnrenamed builder templates or filler text that make a site look half-built | count | named | named + fix |
| AI Readiness | |||
| Is your site ready for AI to find you?6 on-page signals AI assistants (ChatGPT, Perplexity, Google) use to discover & understand you — informational, doesn't affect your score | score | named | named + plan |
| Expert only | |||
| 14 deep security scansExposed files, leaked secrets, directory listing, XML-RPC, ports, subdomain takeover, TLS strength, and more | — | — | ✓ |
| Performance & SEO (Google Lighthouse) | — | — | ✓ |
| Reviewed by a cybersecurity professional | — | — | ✓ |
| Step-by-step fix for every issue | — | — | ✓ |
The free Scorecard is a real audit, not a teaser. It takes five minutes and we email you the result.