Hacker Fortified

Pricing

What a website security audit costs. And what it costs to skip one.

Fixed prices, agreed in writing before any work starts. No hourly meter running in the background. And the first conversation is always free.

Start my free security conversation See the prices

You can find a website "security scan" for free. So why would anyone pay us?

Because a scan answers a small question: does this site have any of the problems on my list?

An audit answers the question that matters: if someone wanted to get into this website, how would they do it, and what would they get?

That takes a person. Someone who logs in as a customer and tries to see another customer's data. Someone who asks who still has admin access, who updates the plugins, and what happens to the backups. Someone who checks your site against ISO/IEC 27001, the international benchmark for information security, and tells you in plain English where you stand.

That's what you're buying. Here's what it costs.

Fixed prices

Three steps. Start with the first, or go straight to the audit.

Step 1

Readiness Review

$1,950 fixed

Find out where you stand, fast.

  • Gap analysis against all ten areas of the Hacker Fortified Standard
  • Careful, non-intrusive testing of your site from the outside
  • Ranked risk register in plain English
  • A 90-day plan, most important fixes first
  • Recorded video walkthrough of your results
  • 30 days of written follow-up questions
  • Full fee credited toward the Certification Audit for 90 days
Ask about a Review

Step 2 · The full audit

Certification Audit

$5,900 per website

Prove it, and earn the badge.

  • Everything in the Readiness Review
  • Hands-on testing of your logged-in site against the OWASP Top 10
  • Review of your policies, suppliers and daily operations
  • Templates for every document the standard requires
  • Every finding mapped to ISO/IEC 27001, with the fix spelled out
  • One full retest of your fixes within 90 days
  • Hacker Fortified Certified badge and public verification record when you pass
Ask about an Audit

Step 3

Fortified Watch

$295 / month

Stay fortified, all year.

  • Monthly vulnerability checks, reviewed by a person
  • Quarterly review of your access, backups and suppliers
  • Your yearly re-audit, included
  • Policy updates as your site and the threats change
  • Priority help if something goes wrong
  • Your badge stays current for as long as Watch is active
Ask about Watch
  • Hacked website recovery, from $1,450. Malware removed, the entry point found and closed, clean files restored, and browser and search warnings cleared. Get help now
  • Remediation, $165 an hour. No developer? We fix the findings for you in prepaid 10-hour blocks, or for a fixed quote.
  • Larger web apps, APIs and several sites, quoted. Typically from $9,500, scoped after a free conversation. Tell us what you run

Do the math

Then compare it with the other number.

Think about what a single bad week would cost you. The cleanup. The days your site is down or flagged by Google. The emails to every customer whose details walked out the door. The contract you lose because a bigger customer asked "is your site secure?" and you didn't have an answer.

An audit is a fixed price you choose to pay. A breach is a bill you don't get to negotiate.

Questions about price

Straight answers.

How much does a website security audit cost?

With us, a Readiness Review is $1,950 and a full Certification Audit is $5,900 for one website, both at a fixed price agreed in writing before work starts. Automated scans cost less because they do less: they check from the outside for known problems and cannot test how your site behaves once someone is logged in, or how your people and suppliers handle access and data.

Why is the Readiness Review credited toward the Audit?

Because we want your first step to be an easy one. If you upgrade to a Certification Audit within 90 days, the full $1,950 comes off the audit price, so the Review costs you nothing extra.

What counts as one website?

One domain running one application, such as a WordPress, Shopify or custom site with its admin area and customer accounts. If you run a larger web app, an API, several sites or several customer portals, we quote after the free conversation, typically from $9,500.

Do you fix the problems you find?

Your developer can, using the step-by-step fixes in our report. If you don't have one, we do the work at $165 an hour in prepaid 10-hour blocks, or for a fixed quote. Either way, we retest to confirm each serious finding is closed.

Is there a contract for Fortified Watch?

Watch is $295 a month on a 12-month term, because it includes your yearly re-audit. After the first year it continues month to month and you can stop anytime. Your badge stays current while Watch is active.

Can I pay in instalments?

Yes. Audits can be split into two payments: half to book, half on delivery of the report.

Not sure where to start?

Tell us about your site. We'll tell you which step fits.

A person replies in writing within one business day with the three risks we'd check first and a fixed price. Free, and no sales calls.

Start my free security conversation