Website Security Consulting. Clear answers before you spend.
Independent advice on how secure your website really is, which vendors to trust, what to do when something goes wrong, and whether to patch or rebuild. For service businesses and for cities, counties, special districts and schools.
Why consulting
Most security spending starts with a guess
Security tools and services are easy to buy and hard to judge. A plugin, a firewall or a new host might be the right move, or it might leave the real risk untouched. Consulting comes first: find out where the site actually stands, then spend on what closes the biggest gaps.
October 2026 showed why. Two critical flaws in PHP, known as PHP2Shell, put every self-hosted WordPress, Drupal and Joomla site on the same deadline. The owners who moved fastest already knew what their sites ran, who patched them and what they would do if one was hit. That knowledge is what a consulting engagement leaves behind.
Consulting is advice and planning. When the plan calls for hands-on work (cleanup, hardening, monitoring, patching), our website security team can do it, or your own team or vendor can. The advice doesn't depend on who does the work.
Services
Four ways we help
Security assessment
A review of your site, hosting, software versions, access, backups and third-party scripts, mapped to a recognized framework such as NIST CSF 2.0, the OWASP Top 10 or CIS Controls IG1, with a prioritized fix list. What an assessment covers.
Vendor and platform review
Before you sign with a host, agency or platform (or renew one), we review their security answers, reports and contract terms and tell you what's missing. How a vendor review works.
Incident response retainer
An agreed plan and a team on call before anything happens, so a hacked site or a flaw like PHP2Shell is a phone call, not a search for help. What a retainer covers.
Secure rebuild advice
Patch, harden or rebuild? We weigh end-of-life software, plugin debt and accessibility work, then plan a rebuild that keeps your URLs and rankings. Planning a secure rebuild.
How it works
A typical engagement
Every engagement is scoped and quoted in writing before work starts.
Scoping call
We learn what your site does, who runs it, what worries you and what decisions you need to make.
Written scope and quote
You get the deliverables, the access we'd need and the price before anything begins.
Review
We look at the site, hosting, vendors and documents in scope, from the outside first and with access where agreed.
Findings in plain English
A report ranked by risk and effort, with what to fix first and who should fix it.
Next steps
We can hand the plan to your team or vendor, help you buy the right service, or do the work ourselves.
For service businesses
Contractors, clinics, law firms and online stores
Your website takes bookings, collects leads and sometimes payments. The questions we hear most: is our site patched, is our host doing its job, do our payment pages meet PCI DSS, and what happens if we're hacked on a Friday night?
If you take card payments on your site, PCI DSS v4.0.1 requirements 6.4.3 (scripts on payment pages) and 11.6.1 (change and tamper detection) have been mandatory since 31 March 2025. Clinics should know the update to the HIPAA Security Rule is still a proposal as of October 2026, not a final rule. Our guide to website security for service businesses covers both, in plain language. It's general information, not legal advice.
For public sector
Cities, counties, special districts and schools
Public-sector sites carry public trust and usually run on small teams and outside vendors. We help with vendor questionnaires and procurement language, review what your vendors run, and plan rebuilds that also meet the ADA Title II web rule. StateRAMP (now GovRAMP) and similar programs matter if you're buying cloud services; CISA's free Cyber Hygiene scanning is worth enrolling in alongside any review.
Our guide to website security for local government walks through it, and our government website security page describes the patch-and-rebuild service.
Who you'll work with
Grigoriy Shvaya
Website security consulting engagements are led by Grigoriy Shvaya, who brings cybersecurity training to every review. He works alongside our development and SEO teams, so findings come with a practical way to fix them.
Background: Cybersecurity training.
Deliverables
What you walk away with
Guides
Learn before you buy
Plain-English guides to each part of website security consulting.
What Is Website Security Consulting? Services, Deliverables and When You Need It
What consulting covers, what you get and when you need it.
Start here →Website Security Assessment: What It Covers and How It Maps to NIST CSF 2.0, OWASP and CIS Controls
What an assessment covers and how it maps to NIST, OWASP and CIS.
Read the guide →How to Review a Web Host, Agency or Platform for Security
Reviewing a host, agency or platform, with a copyable questionnaire.
Read the guide →Website Incident Response Retainers: What They Cover and How to Choose One
What a retainer covers and how to choose one.
Read the guide →Patch, Harden or Rebuild? Planning a Secure Website Rebuild
Patch, harden or rebuild: how to decide.
Read the guide →How to Choose a Website Security Consultant: Credentials, Questions and Red Flags
Credentials, questions and red flags.
Read the guide →Website Security for Service Businesses: What Contractors, Clinics, Law Firms and Stores Need
PCI DSS, HIPAA status and the FTC Safeguards Rule, in plain English.
Read the guide →Website Security for Cities, Counties and Special Districts: A Practical Guide
A practical guide for cities, counties and special districts.
Read the guide →Related
More security guides
Website Security by Platform: What You Are Responsible For, and What You Are Not
Read article →BlogThe Shared Responsibility Model for Websites: Who Secures What
Read article →BlogThe First Hour: A Website Incident Response Plan You Can Actually Follow
Read article →BlogPlugins, Apps and Packages: You Inherit the Security of Everything You Install
Read article →BlogAccess Control and 2FA: Most Sites Are Not Hacked, They Are Logged Into
Read article →BlogBackups: The Control That Decides How Bad It Gets
Read article →BlogPCI DSS 4.0 and Your Website: The Script Requirements Caught Everyone Out
Read article →BlogWhat Is PHP2Shell? A Plain-English Guide for Website Owners
Read article →FAQ
Common questions
How is consulting different from your website security service?
What does it cost?
Do you need access to our server or CMS?
Is a security assessment the same as a penetration test?
Can you work with our current host or agency?
Do you work with public-sector buyers?
Project Managers who will work with you on your project!
Wondering what this costs? Every service has published pricing — no discovery call required to see it.
View pricingKnow where your website stands.
Tell us about your site and what you need to decide. We'll reply with a written scope and a quote.
Book a Strategy Call →