Question 1

What exactly gets audited?

Accepted Answer

Your public-facing footprint and the configuration behind it: domain registration and WHOIS privacy, DNS records, email authentication (SPF, DKIM, DMARC), SSL/HTTPS, two-factor coverage, exposed admin surfaces and password hygiene. Where you give us read-only visibility, we also review your CMS and plugins, hosting and backups, staff account access, third-party integrations, and how payment and customer data are handled.

Question 2

Is the audit really free?

Accepted Answer

Yes. The Security Snapshot Report is always free — no card, no obligation, and no trial that flips to paid. We run it because most small businesses have gaps they've never seen. You're under no pressure to buy anything afterward.

Question 3

How long does it take?

Accepted Answer

The free Security Snapshot Report takes 3–5 business days from the moment we have your brief. A parked-domain lockdown is usually quick; active-email protection includes a staged rollout and a few weeks of monitoring.

Question 4

What does the deliverable look like?

Accepted Answer

A plain-English PDF report. Every finding has a risk rating, what it means for your business in one sentence, and the exact steps to fix it, plus a prioritised remediation roadmap.

Question 5

Is this done remotely?

Accepted Answer

Yes — every audit is fully remote. Most of the work is done from the outside in. For the configuration reviews we either walk through screens with you on a call or you send read-only exports; we never ask for passwords.

Question 6

Do you need access to my systems?

Accepted Answer

Not for the external checks. For the deeper configuration reviews we ask for read-only visibility into specific dashboards, agreed in writing beforehand. You can revoke it the moment the audit is done.

Question 7

Is this a subscription?

Accepted Answer

The Security Snapshot Report is free. Parked-domain lockdown and email protection fixes are one-time services. Email Monitoring, Staff Security Training, the Protect Bundle, and phishing simulations are month-to-month and can be cancelled anytime. Annual prepay costs the same as 10 monthly payments and covers 12 months.

Question 8

Do you offer ongoing monthly monitoring?

Accepted Answer

Yes. Email Monitoring is $49/month and includes DMARC report monitoring, certificate and security-header checks, and a one-page monthly report. It is month-to-month, or you can prepay for 10 months and receive 12.

Question 9

What is included in the Protect Bundle?

Accepted Answer

The Protect Bundle combines Email Monitoring and Staff Security Training for $89/month. That saves $9 each month compared with buying $49 monitoring and $49 training separately. It is the best fit for businesses that want both technical oversight and an alert team.

Question 10

What happens after the report?

Accepted Answer

Most clients can use the report themselves. If you'd rather we handle the email-related fixes, parked-domain lockdown is $149 and active-email protection starts at $299. The active-email service includes SPF, DKIM, and DMARC configuration, a staged rollout, and monitoring during that rollout.

Question 11

Why does the email protection fix start at $299?

Accepted Answer

Most active-email setups are $299. We only quote higher when several services send email for your domain, such as a booking tool, newsletter platform, or customer system, because each sender must be authenticated and tested.

Question 12

Do you train staff on security?

Accepted Answer

Yes. Staff Security Training is $79/month as a standalone service, or $49/month when added to Email Monitoring. The $89/month Protect Bundle includes both. Training covers short videos, enrollment, and completion tracking; practice phishing simulations are available as a $99/month upgrade.

Question 13

Can you build or fix my website too?

Accepted Answer

That's the other half of the business. Website design, build and care plans live at upbuildr.com — same team, same standards.

Questions people ask before booking