Website security is risk reduction —
not a guarantee, and we won't sell it as one.

No — and we won't tell you otherwise. No website can be made completely secure; our work reduces risk in the areas that matter most (access, configuration, updates, backups and recovery readiness), it doesn't guarantee an outcome. Anyone promising a guarantee here isn't being straight with you.

No. Penetration testing is a specific, licensed, authorised testing methodology carried out by qualified personnel, and we haven't published that track record — so we won't claim it. What we offer is a practical website-level security review: access, configuration, update status and backup readiness, with a written list of what we found.

We haven't published evidence of DDoS mitigation or WAF management as a service, so we're not claiming either capability here. If your hosting provider offers these as part of their plan, we can help you understand what's configured — but we don't manage them as a distinct security service.

We won't promise a specific recovery time, because it genuinely depends on severity — what was compromised, whether clean backups exist, and how cooperative your hosting provider is. Some cleanups are straightforward; others require containment, credential rotation, restoring from a clean backup, or escalating to a full rebuild. We'll tell you honestly which situation you're in once we've looked.

We can't promise that, and anyone who does is overselling. A compromised, then cleaned-up site's search visibility is genuinely uncertain — it depends on how long the compromise lasted, what was injected, and how search engines responded. We'll do the cleanup work properly, but we won't promise a ranking outcome we don't control.

No. We do not offer PCI DSS compliance support or certification in any form. PCI DSS compliance is certified by your payment provider and your organisation, not by us — we won't claim otherwise.

We haven't published a track record in regulated-industry security work (healthcare, finance, banking, insurance), so we won't claim that specialism here. If your site has specific regulatory requirements, tell us and we'll be honest about whether our scope fits before taking anything on.

Our evidenced scope covers WordPress and general website-level hardening. We do not currently claim Magento-specific security work. For Shopify, note that Shopify manages its own platform-level security — our work there, if any, is limited to storefront-level configuration, not the platform itself.

Penetration testing, formal compliance certification, managed 24/7 monitoring and DDoS/WAF management are all outside what we offer today. If an incident turns out to need one of these — for example, a compliance auditor requires a certified penetration test — we'll tell you plainly and help you find the right specialist rather than stretching our scope to cover it.