Step 1
Readiness Review
$1,950 fixed
A gap analysis of your website against all ten areas of our standard, plus careful testing from the outside. You get a ranked risk register and a 90-day plan.
Ask about a ReviewFor website owners who have something to lose
Hackers already know where your website is weak. Do you?
Every website on the internet gets tested by attackers. Most owners only find out how theirs did after the damage is done. There's a better way, and it starts with one short message.
Free. Answered in writing by a person. No sales calls, ever.
Here's what nobody tells website owners about hackers.
They aren't looking for you.
That sounds like good news. It isn't.
Hackers don't choose targets the way burglars choose houses. They write programs that knock on every door on the internet, all day and all night, looking for the one that's unlocked. An old plugin. A reused password. An admin page someone forgot about. A contact form that trusts whatever gets typed into it.
Your website gets knocked on too. A program doesn't care whether your site sells cupcakes, books appointments or runs your blog.
So the real question isn't whether someone will try. It's what they'll find when they do.
And here's the part that should worry you most.
When a break-in works, there's often no alarm. No broken glass. Nothing looks different. A copy of your customer list quietly leaves through a door you didn't know was open.
You find out later. From a customer who got a strange email. From Google, which can put a red warning screen in front of your site. From a letter you'd rather not open.
By then, every option costs more.
So why doesn't a free scanner catch it?
Because a scanner only checks the locks it already knows about. It can't tell that any logged-in customer can read someone else's orders. It can't see that a contractor you parted ways with two years ago still has admin access. It has no idea that nobody actually owns your plugin updates.
Those are the doors real attackers walk through. Finding them takes a person who thinks like an attacker and checks like an auditor.
That's exactly what we do.
Hacker Fortified audits your website against a standard built on ISO/IEC 27001, the international benchmark for information security, scoped to what a website owner actually controls. We test your site the way an attacker would. We check the people, suppliers and daily habits around it the way an auditor would. Then we help you fix every serious problem and prove that it's fixed.
When you're done, you've earned something a scanner can never give you: the Hacker Fortified badge, with a public record anyone can check.
It all starts with a free conversation, in writing. Tell us about your site, and we'll reply with the three risks we'd check first, whether you hire us or not.
What's at stake
Ask yourself one question. What would a break-in cost you?
Your data
Customer records walk out the door.
Emails, passwords, addresses and payment details are what attackers come for. Once copied, they are gone for good.
Your reputation
Trust takes years. A breach takes a day.
Customers remember the email telling them their data was leaked. Google may also flag a hacked site and drop it from search.
Your revenue
Downtime, cleanup, lost deals.
Recovering after an attack costs far more than preventing one. And when a bigger customer asks "is your site secure?", a shrug loses the contract.
What it costs
Fixed prices. No surprises. Start wherever you are.
Most owners start with a Readiness Review. If you upgrade to the full Certification Audit within 90 days, every dollar of it counts toward the audit.
Step 2 · The full audit
Certification Audit
$5,900 per website
Everything in the Review, plus hands-on testing of your logged-in site, a review of your policies and operations, document templates, a retest, and the Hacker Fortified badge when you pass.
Ask about an AuditStep 3
Fortified Watch
$295 / month
We keep watch after the work is done: monthly expert-reviewed checks, quarterly control reviews and your yearly re-audit. Your badge stays current for as long as you're on Watch.
Ask about Watch- Hacked right now? Recovery from $1,450: malware out, entry point closed, warnings cleared. Get help now
- No developer? We fix findings for you at $165 an hour in prepaid blocks, or for a fixed quote.
- Bigger web app or several sites? Quoted after a free conversation. Tell us what you run
How it works
From "we're probably fine" to proof, in four steps.
Start a conversation
Tell us about your site. A person replies in writing within one business day with the three risks we'd check first. Free.
We audit
Once you approve a fixed scope and price, we test your site like an attacker and review its controls like an auditor.
You fix, we verify
Every finding comes ranked by business risk with the fix spelled out. We retest to prove each serious one is closed.
Show your badge
Pass, and your site earns Hacker Fortified Certified, with a public record anyone can check.
The Hacker Fortified Standard
Built on ISO/IEC 27001. Cut down to what your website actually needs.
ISO/IEC 27001 is written for whole organizations. We took the parts that protect a website, its data and its customers, and turned them into ten areas we audit every time. We add the customer-care habits of ISO 9001, because sloppy operations cause as many breaches as sloppy code.
- Scope and ownership
- Risk assessment
- Access and passwords
- Patching and configuration
- Application security
- Data protection and privacy
- Suppliers and plugins
- Backups and monitoring
- Incident response
- Sound operations
See how each area maps to ISO 27001 and ISO 9001 · Score your own site free
No one has ever regretted reaching out too soon.
The Hacker Fortified promise
Hacker Fortified Certified
Then show the world your doors are locked.
Sites that pass our Certification Audit earn a badge for their footer. Anyone who clicks it sees a live record of when the site was audited and that every serious issue was fixed.
- Earned, not bought: every critical and high-risk finding fixed and retested, and the core security and operations documents in place.
- Verified: each badge links to a record for that one domain.
- Kept current: valid for 12 months, or for as long as you're on Fortified Watch.
- Honest: it shows you're aligned with ISO/IEC 27001 practices. It is not an ISO certificate, and we never say it is.
How the badge looks in a client's site footer. See an example verification record.
Questions
You probably have a few questions.
Is my small website really a target?
Yes. Most attacks are automated. Bots scan every site on the internet for known weaknesses, whatever its size or who owns it. Small sites are often easier to break into because nobody is watching them.
Is Hacker Fortified Certified the same as ISO 27001 certification?
No, and we will never pretend it is. Only accredited certification bodies can issue an ISO/IEC 27001 certificate. We audit your website against the Hacker Fortified Standard, which is built on ISO/IEC 27001 and scoped to what a website owner actually controls. It gets you aligned with the same practices, gives you honest answers for customer security questionnaires, and is a practical first step if you ever go for formal certification.
Why not just run a free security scanner?
Scanners are useful, and we use them too. But a scanner can only spot known problems from the outside. It cannot tell that any logged-in customer can read someone else's orders, that a former contractor still has admin access, or that nobody owns your plugin updates. Those are the holes that cause real breaches, and finding them takes a person.
How much does it cost?
The first conversation is free. A Readiness Review is $1,950, fixed, and the full fee is credited toward a Certification Audit if you upgrade within 90 days. A Certification Audit is $5,900 for one website. Fortified Watch, which keeps your site and your badge current, is $295 a month. Hacked website recovery starts at $1,450. Full pricing.
What happens after I start a conversation?
A person reads what you send, takes a first look at your site from the outside, and replies in writing within one business day with the three risks we would check first and a recommended next step with a fixed price. There is no obligation, and the whole conversation stays in writing.
Will testing break my website?
No. We agree the scope and timing with you in writing, test carefully, and can work against a staging copy of your site if you prefer.
My site has already been hacked. Can you help?
Yes. We remove the malicious code, find and close the hole the attacker used, restore clean files, and help you clear search engine and browser warnings. Recovery starts at $1,450.
How do I earn the Hacker Fortified badge?
Complete a Certification Audit, fix every critical and high-risk finding (we retest to confirm), put the core security and operations documents in place, and sign a short commitment to keep them. The badge is valid for 12 months, or continuously while you are on Fortified Watch, and links to a public verification record for your domain. The full rules.
Start a free security conversation
The cheapest time to reach out is right now.
After a break-in, every fix costs more. Tell us a little about your site and a person will reply in writing within one business day. No phone tag, no sales calls.