Getting found & locked down
Two things that get quietly skipped.
Being properly listed where people actually look, and being locked down so nobody helps themselves to your site. Both are one-off jobs with a fixed price. Neither is a monthly retainer, and I am not going to sell you one.
Three ways to buy this
Same work either way — the difference is only whether you are already having something built.
Already in the small business build
If I build your site, the getting-found half is in the price. It is one of the bullets on that package and it stays there. You do not need this page for it.
Bolted on to any build
One-pager, small business site or bespoke — either job can go into what you are already having done, priced inside the same fixed quote rather than turning up later as an extra.
On its own
Somebody else built your site, or you built it yourself, and nobody ever did this part. That is most of the people who ask. I do not need to have built it — I need access to it.
Getting found
A fixed list of things that either exist or do not. Done once, checked, and handed over in your name.
Search Console and Bing Webmaster
Both verified on your actual domain, in accounts that belong to you rather than to me. If you and I ever part company you keep them, and you do not have to ask me for anything.
A sitemap they have actually read
Submitted, and then looked at again a few days later to confirm it was parsed and how many pages went in. Submitting it is the easy half; almost nobody goes back and checks.
Google Business Profile and Bing Places
Created or claimed, filled in properly, and taken all the way through verification. Verification is the bit that stalls, and chasing it is the bit you are paying for.
Apple Business Connect
So the business exists in Apple Maps, and when somebody asks Siri where you are. Roughly half the phones round here are iPhones, and this one gets missed almost every time.
The right business type in the code
The structured data checked, so search engines are told what you actually are. And checked for the thing that catches sole traders out — quietly publishing your home address, because that is what the form asked for and nobody thought about it again.
AI crawlers let in on purpose
Checked so ChatGPT and Perplexity can read the site and cite it, if that is what you want — or cannot, if it is not. Either one is a decision. Having it happen by accident is not.
Written down at the end
What was done, where the logins are, and the two or three things worth looking at in six months. A couple of pages, in English, and yours to keep.
What this is not
Not SEO. There is no monthly fee, no keyword package, and no promise about where you rank — anybody promising that is guessing at best. This is the groundwork that has to exist before ranking is even a sensible conversation, done once, properly.
Locked down
A point-in-time check on a site that already exists. You can have the report on its own, or the report and the fixes.
HTTPS that is actually forced
Not merely available — enforced, with the old TLS versions refused and the plain-http address redirecting properly rather than quietly carrying on serving.
Headers that stop an injected script
A content policy that states which code is allowed to run on your pages, so a script that gets injected — through a plugin, an advert, a compromised login — does not execute. This site has one, and you can go and read it.
Clickjacking closed
Your site cannot be loaded inside somebody else's page and used to get one of your customers to click something they cannot see.
Forms that cannot be used as a relay
Contact forms rate-limited and checked. An unprotected form is a free way for somebody to send spam with your domain on it, and the way you find out is your own email starting to bounce.
A look at what it is built on
Dependencies checked against known vulnerabilities — the plugin last updated in 2019, the library with a published CVE against it. Nine times in ten this is where the actual hole is, not in anything clever.
Logins and DNS reviewed
Who has access and whether they still should, two-factor where it is missing, and the DNS records read properly — including the ones that stop somebody sending email as you.
A report you can read
Plain English, ordered worst first, saying what I would fix, what I would leave, and why. If there is nothing much wrong I will tell you that, and the assessment is all you pay for.
What this is not
Not a penetration test and not a compliance certificate. If you need either — an insurer asking, a contract requiring it — you need somebody with the letters after their name, and I will tell you that rather than take the work. It is not monitoring either. It is a check, on a date.
On the security half, since it is fair to ask why me. In June I wrote up a Semantic Kernel vulnerability Microsoft rated 9.9 and why the official fix left agents exposed anyway, then the second, worse one a fortnight later. Neither post is about small-business websites. That is rather the point — a shop site is a much simpler problem than an AI agent with tool access, and it is the same habit of reading what is actually there instead of what the label says.
And the honest limit on both jobs: everything above is work with a definite end. I am not selling you a position in search results, because nobody can, and I am not selling you the promise that nothing will ever go wrong, because nobody can do that either. What you get is a list of things that were not done, done — and a written record of it, so in a year you can check rather than wonder.
What it costs
Starting prices, and you get a fixed number before anything starts — same as everything else here. What moves it is how many pages there are and what the site was built with.
Getting found
from £300
The whole list above: both search consoles, the sitemap confirmed parsed, Google, Bing and Apple listings taken through verification, structured data and AI access checked, and the written handover.
Verification at Google's end can take a fortnight and is not in my hands. Chasing it is, and it is included.
Locked down
from £250
£250 to assess it and write it up. £450 to assess it and fix what the report finds, which is what most people want once they have read the report.
If it turns up nothing worth doing, you pay for the assessment and I tell you so plainly. You can also take the report and hand it to your own developer — sometimes that is the cheaper route and I will say when it is.
Both together
from £650
Both jobs in the same week, with one handover document covering the lot. Cheaper than the two separately because the domain, the DNS and the hosting only get learnt once.
An annual re-check is £150 if you want one. You book it by emailing me — it is not a subscription, nothing renews, and if you never email me nothing happens and nothing is charged.
Where I come out to
New Holland, Barrow and Barton-upon-Humber, Goxhill, Immingham, Brigg, Scunthorpe, Grimsby and Cleethorpes — and over the bridge to Hull, Hessle and Beverley. If you are just outside that, ring anyway and I will tell you straight whether it is worth it.
Questions I get asked
Is this SEO?
No, and I would rather be blunt about it than let you find out later. SEO as it is usually sold is a monthly fee for ongoing work of uncertain value. This is a fixed list of things that either exist on your site or do not, done once, and then they are yours. If you want somebody working your rankings every month, that is a different person and a different budget, and I will say so.
Will this get me to the top of Google?
I do not know, and neither does anybody who tells you they do. What I can tell you is that a business Google cannot verify, with no sitemap it has read and the wrong business type in the code, is not getting there. That is the part I am fixing. Ranking is what happens afterwards, and it depends on things neither of us controls.
Do I have to have had my site built by you?
No, and most people asking for this did not. Usually somebody else built it and has since stopped answering emails. I do not need the original builder — I need access, and if you have lost that I can usually help you get it back first.
I already paid you for the site. Am I paying twice?
No. Getting found is one of the bullets on the small business package and it stays in it. This page is for two other sorts of people: somebody else built your site and nobody ever did this part, or you want the security half as well. If you are a build customer and something on that list is missing from your site, tell me and I will finish it — not invoice you for it.
Is there a monthly fee for any of this?
There is not, and there is not going to be. The rest of this site promises you no stack of subscriptions you have forgotten about, and I am not going to contradict my own page. There is an optional £150 re-check a year later, which you get by emailing me and asking for it. Never email me and nothing happens and nothing is charged.
What if you find something serious?
You hear it the same day rather than at the end in a document. And if it is something I should not be the one handling — an actual intrusion, card details, anything with a legal reporting duty attached — I will tell you that plainly and point you at somebody who does that for a living.
Tell me what it's doing
Tell me the domain and roughly who built it. I will tell you which of the two you actually need — which is sometimes only half of one, and occasionally neither.
Or email [email protected]
