What you get for it.

Automated Scan

A machine-generated report on the handful of things a machine can check without guessing. No human reads it — which is exactly why it costs £5 and arrives in minutes.

• The everyday protections a browser expects, and where yours fall short
• Whether your site is properly encrypted — and stays that way
• Whether a stranger could send email that looks like it came from you
• What your site quietly gives away about itself before anyone signs in

It never opens a browser, so it says nothing about performance, accessibility, or your code — that is what everything above it is for. Want the technical detail behind a finding? Email me and I'll talk specifics.

Automated Review

The scan, plus an automated read of the pages a visitor actually lands on. Still no human — a machine finds the obvious things fast and tells you which to fix first.

• Everything in the Automated Scan
• Your public pages read for the problems visitors hit first
• Anything a stranger can reach that they should not be able to
• Findings ranked, so you know where to start

Automated, and labelled as such. It finds the obvious things fast; it is not a substitute for someone reading your code.

Automated Deep Review

The review, run across the whole public site rather than the front door — every page, and the flows that matter: signing in, checking out, sending a form. No human reads it, which is what keeps it at this price.

• Everything in the Automated Review
• Every public page, not just the ones you send people to
• Sign-in, checkout and forms checked for the common ways they go wrong
• A prioritised summary you can hand straight to a developer

Accessibility Snapshot

WCAG 2.2 AA against your three most important journeys, tested with a screen reader rather than only a linter, plus a conformance statement you can publish.

• Three journeys tested by hand, with assistive technology
• Findings mapped to specific WCAG 2.2 success criteria
• A conformance statement you can publish, written to be defensible
• The gap list you would need to close to claim full AA

Written to be shown to a customer or a regulator, not just to your developers.

Bug Hunt

One reproducible bug that has beaten your team. I find the root cause, and you get the reasoning, not just a patch.

• Root cause analysis written up in full
• A minimal reproduction you can keep in your test suite
• A proposed fix, as a patch or a pull request
• Notes on what let it happen, so the class of bug closes too

Performance Audit

Why your site is slow, in specifics. Field data and lab data, the render path, the payload, and the queries behind them.

• Core Web Vitals breakdown from real user data where available
• Waterfall and bundle analysis with the actual offenders named
• Server and query-level findings where they dominate
• A ranked list of changes with expected millisecond savings

UX & UI Review

A structured critique of the flows that matter to your revenue: onboarding, checkout, and whatever your support inbox complains about most.

• Heuristic review of up to five core journeys
• Annotated screen-by-screen teardown
• Accessibility pass against WCAG 2.2 AA
• Prioritised fix list, sequenced by effort against impact

Security Audit

A full pass over your application's attack surface — authentication, authorisation, injection, dependencies, headers, and the way secrets move through your stack.

• Written report, findings ranked by exploitability and blast radius
• Proof-of-concept for anything I claim is exploitable
• Concrete remediation for each finding, not just a CVE number
• A 60-minute walkthrough call with your engineers

Discovery Deposit

Holds a slot in the schedule and pays for the scoping session. Credited in full against the engagement we agree.

• A 90-minute scoping session over video
• Access review of the repository or environment in question
• A written scope and fixed quote within three working days
• Your slot held for 14 days while you decide

Deducted from the final invoice. Fully refundable if I decide the work isn't a fit.