Small things, fixed properly.
A full assessment starts at ₹45,000 and takes the best part of a week. Sometimes you don't need that — you need one specific thing fixed by someone who has done it before. These are scoped tightly enough to quote without a call, and priced so that hiring me the first time isn't a decision you need to take to a committee.
Stop your domain being spoofed
Anyone can currently send email that appears to come from your domain.
- ▸SPF, DKIM and DMARC published correctly for every legitimate sender you have
- ▸Reporting switched on, so you can see who is sending as you
- ▸Two weeks of report triage — I read them, you don't
- ▸A go/no-go call on moving to enforcement, with the evidence behind it
- ▸The final move to p=reject once nothing legitimate is failing
Migrating your mail platform, or fixing a sender that refuses to support DKIM — I will tell you if we hit one.
Security headers, done properly
The cheapest controls you will ever deploy, and most sites are missing several.
- ▸Every response header set correctly for your stack, not copy-pasted
- ▸A Content-Security-Policy deployed in report-only first, so nothing breaks
- ▸Violation reports reviewed with you before enforcement
- ▸Verified A or A+ on securityheaders.com, or you don't pay
- ▸A short written note on what each header does, for whoever inherits it
Rewriting inline scripts your CMS or analytics injects. If that's what blocks a strict CSP, I'll say so on day one rather than at the end.
What the internet can see
Most breaches start on something nobody remembered was exposed.
- ▸Every subdomain I can find, including ones from certificate transparency logs
- ▸What is actually listening on each, and what it identifies itself as
- ▸Forgotten admin panels, staging environments and default pages
- ▸Expired or expiring certificates, and hosts that were meant to be decommissioned
- ▸A prioritised written summary — what to turn off, what to look at, what is fine
Exploitation. This is reconnaissance only, entirely passive and non-intrusive. If it finds something worth testing properly, that is a separate conversation.
How payment works. Half up front, half on delivery, invoiced. No retainer, no minimum, no subscription. If the work turns out smaller than quoted, the price comes down — it does not go up mid-job.
If it isn't right.The headers job has a stated pass mark, and if it doesn't hit it you don't pay. The other two are judgement work rather than a score, so instead: tell me it fell short and I'll either fix it or refund it. I would rather do that than argue with someone who is going to tell other people about it either way.
Not sure which? Run the free checks first — they will tell you whether you have any of these problems before you spend anything. If they come back clean, that is your answer and I'll say so.