Security+

Where is your website exposed?

I review websites, web apps and the hosting behind them for security gaps, and tell you in plain English what to fix first. Then I can fix it, and keep watching so it stays fixed.

Ask about Security+Packages from R1,950 · Watch is month to month, no lock-inor see what I check

Built for the way small businesses run their web

Most small businesses don’t have a security team. They have a website a freelancer built, a hosting account, a contact form, maybe a customer login, and a few packages and third-party tools nobody has looked at in a year. That is what I review.

  • Websites and web shops. Marketing sites, online shops and booking forms built on a modern stack, such as Next.js.

  • Web apps and software. Customer portals, internal tools and SaaS products, including the code, the logins and the data behind them.

  • Hosting and domains. Where it all runs: your host, your DNS, your email records and your backups.

What I look at

  • Security headers and HTTPS

    Whether browsers are told to protect your visitors, and whether anything loads over an insecure connection.

  • Out-of-date software

    Frameworks, libraries and packages with known security fixes you haven’t installed yet.

  • Logins and access

    Weak or shared admin accounts, missing two-step sign-in, and who still has access who shouldn’t.

  • Forms and data

    Contact forms, uploads and customer details: spam, abuse and where the information ends up.

  • Secrets and settings

    Passwords or keys sitting in code, public files or old backups.

  • Email and domain records

    The settings that stop others sending email as you.

  • Hosting and backups

    Whether you can recover if something goes wrong, and how quickly.

  • Third-party scripts

    The analytics, chat and tracking tools your site loads from other companies.

How an engagement runs

  1. You tell me what you have.

    A short chat or message about your site, app or hosting. I tell you honestly whether I can help.

  2. You choose a package.

    The price is fixed and agreed before I start. If you need more than the package covers, I tell you before going over.

  3. I review and report.

    A written report in plain English: what’s wrong, how serious it is, what to fix first.

  4. I fix it, or hand it on.

    I can make the fixes in your code or hosting, quoted before I start, or give your developer clear instructions.

Then keep watching

Websites change and new weaknesses turn up. Ongoing monitoring means I check on a regular schedule: scanning for known weaknesses and out-of-date software, watching that your site is up and your certificates and domain are valid, and checking your email records haven’t changed. That is Watch, R450 a month. Month to month, no lock-in. Anything that needs fixing is quoted before I start.

I hold my own sites to the same standard

The rebuilt erzo.co.za ships with security headers set and tested, and I checked that its email records were untouched when it went live. I’ve also built production systems for regulated environments including food safety, property management and healthcare, where mistakes cost money.

Security+

What it costs

  • Remote. I work with clients in South Africa, the UK and the US.

  • Fixed prices, agreed before I start.

  • Fixes are quoted before I start, at R750 per hour.

  • Quick Scan

    R1,950

    • Automated checks of your site, hosting, security headers, DNS and email records
    • A plain-English list of what to fix first
    • A 30-minute call to go through it

    Run only with your written go-ahead, and only with checks that don’t disrupt your site.

  • Security Review

    R5,950

    • Everything in the Quick Scan
    • A manual review of logins and access, backend and database rules, and backups
    • A written report in plain English, most serious problems first
    • One free re-check

    I read your configuration, code and settings. I don’t run attack simulations against live systems.

  • Watch

    R450 a month

    • Regular checks for known weaknesses and out-of-date software
    • Alerts if your site goes down, or a certificate or domain is close to expiring
    • Your email records checked, and a short note each month

    Month to month, no lock-in. Anything that needs fixing is quoted before I start.

Larger sites and web apps get a custom quote. Tell me what you run and I’ll suggest where to start.

Ask about Security+

Common questions

Do you do penetration testing?

I review security by reading configuration, code and settings. I don’t run attack simulations against live systems. If you need formal penetration testing, I’ll say so and point you to a specialist.

Do you review WordPress sites?

No. I work on modern-stack sites. If your site is on WordPress, the better route is to rebuild it on a modern, fast stack, and I can talk you through what that involves.

Will you test my live site?

Only with your written go-ahead, and only with checks that don’t disrupt it.

Does this make me POPIA or GDPR compliant?

No review can promise that. I’ll tell you where your site collects personal data and where the technical protections are thin. Compliance advice is for your lawyer.

Do you fix things too?

Yes. Fixes are quoted before I start, at R750 per hour, or I give your developer instructions.

Can you guarantee my site is secure?

No one can. I can reduce the real risks and give you a clear picture of what’s left.

Not sure where your site stands?

Tell me what you run and where it’s hosted. I’ll tell you what I’d look at first.

Ask about Security+or email [email protected]

South African time (SAST, UTC+2). I reply to every message myself, within 24 hours.

Security+ and Accessibility+ work well together: Security+ looks for security gaps, and Accessibility+ checks that everyone can use your site. See Accessibility+