Website Security Checks and Technical Hardening
Honest outside-in security checks, WordPress cleanup, email domain protection, and server hardening for New Zealand and Australian businesses.
Honest website security, without fear tactics or sales calls
Website security is the practical engineering of keeping software patched, locking down access points, and protecting your domain identity against automated attacks. Our services provide clear diagnostics and fixed-price fixes without scare tactics, ongoing lock-in, or pushy sales calls.
Our free outside-in check examines only what is publicly visible: response headers, TLS certificates, public DNS records, and exposed CMS version markers. Anything beyond that - including probing unlinked files, testing passwords, fuzzing, or reviewing internal source code - requires the owner's explicit written permission. This boundary respects New Zealand and Australian computer crime legislation, including Section 252 of the New Zealand Crimes Act 1961 and Part 10.7 of the Australian Criminal Code Act 1995. Checked on 26 October 2026 against both Acts on legislation.govt.nz and legislation.gov.au.
We are honest about our limits. No security consultant can guarantee that a website is unhackable or immune to future threats. We operate during standard business hours with a same-day option for emergencies, not an around-the-clock call centre. NullGlitch is a sole trader and not GST-registered, so no GST is added.
What’s included in Website Security Services
Built around commercial clarity, faster delivery, and clean execution.
Free outside-in security check
Passive review of public security headers, SSL certificate expiry, public CMS version markers, and email authentication records.
php2shell check and PHP update
Dedicated update of PHP to fixed releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35) and a check for obvious signs of compromise.
Hacked WordPress cleanup
Complete removal of webshells and backdoors, clean core and plugin reinstallation, credential rotation, and hardening.
Email domain protection (DMARC)
SPF, DKIM, and DMARC setup across Microsoft 365, Google Workspace, SendGrid, and SES, so forged invoices from your exact domain get refused and your real mail stays out of spam.
Server update and hardening
OS and PHP updates to supported releases, SSH key enforcement, UFW firewall, fail2ban, and backup verification.
Web app security review
Written code and configuration review of Next.js, Shopify apps, or custom PHP apps against the OWASP Top 10 2025 and ASVS 5.0 Level 1.
How the project runs
Clear phases, no mystery, and no padded process theatre.
Free Diagnostic
Submit your website and email domain for our passive outside-in security check.
Written Report
Receive a plain-English scorecard with prioritised findings within 1 business day.
Agreed Scope
Choose the fixed-price fix you need. The scope and the owner's written permission are both in writing.
Hardening & Handover
We complete the remediation, verify functionality, and provide clean documentation.
Website Security Services Pricing
Transparent options for website security services work, scoped around delivery rather than fluff.
Free Outside-In Check
Passive public inspection of headers, SSL, and DNS
- Passive check of public web and DNS markers
- Traffic-light status report (Red / Amber / Green)
- Plain explanation of what each finding means
- Practical fixing steps for your developer
- Delivered within 1 business day
- No sales calls or persistent marketing lists
php2shell Check and PHP Update
Focused PHP runtime update and site compromise check
- PHP updated to supported release (8.5.12, 8.4.27, 8.3.36, 8.2.35)
- Patches CVE-2026-109618 and CVE-2026-109619
- Site health and compromise indicators checked
- Shared hosting check and written host request
- Tested on staging or with rollback snapshot
- NullGlitch is a sole trader and not GST-registered, so no GST is added
Hacked WordPress Cleanup
Malware eradication, core reinstall, and site hardening
- Malware, backdoors, and webshells removed
- Core and plugins reinstalled from clean sources
- All credentials and database salts rotated
- Root cause identified and upload folder locked
- Free re-clean within 30 days if reinfected through same hole
- Same-day option at NZ$795, business hours
- NullGlitch is a sole trader and not GST-registered, so no GST is added
Email Domain Protection
SPF, DKIM, and DMARC enforcement across mail services
- Full audit of sending services (Google, 365, SendGrid, SES)
- SPF and DKIM cryptographic records aligned
- DMARC policy deployed to quarantine or reject
- Protects domain against invoice fraud and spoofing
- Optional ongoing report monitoring at NZ$49 a month
- NullGlitch is a sole trader and not GST-registered, so no GST is added
Server Update and Hardening
Linux OS, PHP, firewall, fail2ban, and backup checks
- OS packages and PHP updated to supported releases
- SSH key-only authentication and port lockdown
- UFW firewall and fail2ban brute-force protection
- TLS configuration and certificate check
- Backup system verified with a test restore
- Optional monthly security patching at NZ$149 a month
Web App Security Review
Written review mapped to OWASP Top 10 2025 and ASVS 5.0 Level 1
- Covers Next.js, Shopify apps, or custom PHP apps
- Authentication, session, and secrets storage review
- Input handling, injection, and security headers checked
- Dependencies checked against public CVE databases
- A security review, not a penetration test
- Delivered with a prioritised remediation action plan
All prices are estimates. Final quote based on project scope. Contact us for a custom quote.
Questions before you commit
Straight answers on timing, scope, support, and what happens after launch.
The free check is strictly passive. It looks only at what your website publicly presents to any web browser or mail server: HTTP security headers, SSL certificate expiry and ciphers, public CMS version markers, public email authentication records (SPF and DMARC), and public blocklist listings. It does not probe hidden files or attempt logins.
Ready to move this forward
If the goal is cleaner delivery, stronger proof, and a site or system that earns its keep, let’s scope the next step properly.