Service · Small business · Security
Website & Domain Security Checkup
For a lot of small businesses, nobody in particular looks after the website, the domain, or the business email. A domain lapses. An old API key sits in a GitHub repo. The recovery email on the registrar account belongs to someone who left three years ago. Then one day the site is gone.
I find these problems before they cost you anything.
1. The Checkup (one-time setup)
This is a read-only audit. I look at your setup and don't change it. You get a written report with every finding ranked from most to least serious. Each finding says what's wrong, how to fix it, and who can make the fix: you, your web person, your registrar, or me.
What I check
- Domain expiry and registrar locks. When does the domain expire? Is auto-renew on? Is it locked against transfer and deletion?
- Recovery emails. Are your registrar, DNS, and hosting accounts tied to email addresses on domains you don't control?
- Email records (SPF and DMARC). Can someone send email that looks like it came from you?
- HSTS. Does your site force secure connections?
- CSP and third-party scripts. Is your site loading code from sources you don't need or can't trust?
- Leaked keys in GitHub history. Passwords and API keys that were committed once and never rotated.
- Exposed repo files. Config files, build files, and other internals your site hands to anyone who asks for them.
2. Domain & Lookalike Watch (monthly care)
- Daily checks of your domain record, your site, and your DNS. If something changes or goes down, you hear about it.
- Lookalike watch. I look for newly registered domains that contain your name or brand, including typo and hyphenated versions. If one shows up, I tell you when it was registered, who registered it if that's public, and whether a site is live on it.
- I only message you when something actually changed.
What a Checkup turns up (anonymized example)
A small business's audit turned up these findings, ranked from most to least serious:
- The main domain was a few weeks from expiring.
- An old API key was still sitting in the history of a public repo.
- The site was serving internal repo files to anyone who asked for them.
- The site loaded a third-party script from a domain known for abuse.
Each finding went into the report with its fix and the person who could make it. The owner renewed the domain and checked the registry record before changing anything else. The repo files and the script were fixed only after the owner approved the changes.
Pricing
Small-shop starter checks
| What | Price |
|---|---|
| Website check | $25 |
| Quick check | $149 |
| Camera/NVR lockdown | $299 |
| Phishing session | $199 per team |
Work starts once payment lands. Pay through the Hire Sam / Pay or donate box below.
Full Checkup and monthly care
| What | Price |
|---|---|
| Small-shop Checkup (one domain, one site, one repo) | starts at $1,500 |
| Larger Checkup (several domains and sites, more repos, more complex email) | $1,500 to $15,000, quoted up front |
| Domain & Lookalike Watch (monthly care) | $750 to $1,500 a month |
| Fixes and extra work by the hour | $90 to $175 an hour |
Starter checks start at $25; larger engagements are quoted from the table above. No free work and no friends-and-family discounts.
How I work (this is part of what you're paying for)
- Read-only first. The Checkup looks. It doesn't touch.
- Nothing gets changed without your OK. You approve every fix on the list before it happens.
- Real and legal only. I only check things you own or have the right to check. No hacking anyone else, no scare tactics, and no made-up findings.
- Your data stays private. Findings go to you and nobody else.
Using AI in your business too?
The same approach of reading first and measuring before you trust anything carries over to AI tools. If you're putting a chatbot or language model in front of customers, start with my write-up on guardrails.
Get started
Email me your business name and domain. I'll reply with a quote and a list of what I'd need from you.
Email artificialActuary@gmail.comRelated: Open-Source AI Guardrails · Brand Alerts · Blogs