The audit tells you what is broken. This hands you the files that fix it.
A Fix Pack converts findings into the actual change files — security headers written for the platform that serves your site, the exact DNS record text, markup to paste into your homepage. Every file passes our own check before it is sent, and once you have applied them we re-measure your site and tell you what took effect. You or your developer apply them. We do not need access to your site.
security-headers-wpengine.txt
Header rules in your host’s own format, named for it: WP Engine Web Rules here; a Cloudflare rule, a WordPress plugin file, a Drupal, Vercel, Netlify, Apache or nginx block elsewhere. Not issued at all on a platform that cannot apply them.
dmarc-record.txt / spf-record.txt
The exact TXT record text for your DNS zone, with the host name it belongs on.
structured-data.html
Schema.org markup for the homepage <head>, built only from the business name, phone number and address you confirm.
What we could not fix, and why
Anything we found but did not turn into a file, named in the delivery email with the reason. Disclosed, and not charged for.
Where is your site hosted?
The host decides whether the security-header fixes can be applied at all, so every order starts here. Pick yours and the answer appears below. Nothing is sent until you choose to email us, and we confirm the host from your site’s own response before quoting: if it differs from what you picked, the answer for the real host applies.
Files, not instructions describing files.
Every Fix Pack has the same structure, whether it contains two files or nine.
The change files
One file per kind of fix, written for the exact system it belongs to — your host’s header settings, your DNS zone, or your page markup. Not instructions describing a change. The change itself.
Where each one goes
Every file states its target plainly: the host setting or configuration file, the DNS TXT record, the homepage <head>. No guessing which file to open.
Checked, then re-measured
Every file passes our own check before it is sent: well formed, nothing already on your site dropped, no placeholder left in. When you have applied the pack, we re-measure the same checks and send a written before and after. Applied is not the same as working.
What we could not fix
Anything we found but cannot safely turn into a file — a setting your platform does not allow, a change needing human judgement — is listed by name with the reason. Disclosed, never padded, never silently dropped.
Nine kinds of defect, converted into files you can apply.
These are the categories the engine can generate a checked file for. Some need one fact from you first, such as the phone number to link or the mailbox for DMARC reports, because we do not invent facts about your business. A finding outside these categories is reported by the audit but is not part of a Fix Pack, and we say so rather than padding the pack.
Security headers
Referrer-Policy, Permissions-Policy, Strict-Transport-Security and the rest, plus a report-only Content-Security-Policy that reports problems without blocking anything on your pages. Written in the format of the platform that serves your site: a WP Engine Web Rule, a Cloudflare Transform Rule, a WordPress plugin file, a Drupal settings block, a Vercel config entry, or a header block for Netlify, Nginx or Apache. Site builders such as Squarespace, Shopify and Wix give owners no way to set these, and we decline those sites before any request.
DMARC
A monitoring-only DMARC record (p=none) for a domain that publishes none. It changes nothing about mail delivery today; it starts reports flowing to a mailbox you name, so you can see who sends mail as your domain.
SPF
Where a domain publishes two SPF records, or one that ends in +all: a single corrected record that keeps every sender already listed. Where a domain has no SPF record and receives no mail: a record stating that nothing sends as it. A domain that sends mail but has no SPF record needs someone who knows every service sending for it, so we name that rather than generate it.
Structured data
Schema.org LocalBusiness markup for your homepage <head>, built only from the business name, phone number and address you confirm. Nothing is inferred.
Meta description
The meta description tag, the text that appears under your listing in search results, in wording you supply. We do not write claims about your business for you.
Mobile viewport
The viewport declaration that determines whether your site renders at readable size on a phone at all.
Click-to-call
A tappable link for the phone number you give us, to wrap around the number in your header or contact area.
Tap-to-call switched off
Where your pages tell phones not to turn numbers into links (format-detection telephone=no), the tag to remove so visitors can tap to call.
Robots and sitemap
A Sitemap line for your robots.txt, pointing at /sitemap.xml, added under your existing rules without changing any of them, or a basic robots.txt if you have none.
One price, with no count and no cap.
One flat price for every fix we can generate for your site. There is no per-fix count and no cap: in testing, a cap only ever meant withholding a fix a customer should have received.
Who this is for, and who it is not for.
A good fit if
- You have had an audit, or already know what is wrong
- Your site is on a host the host step accepts
- You or your developer can apply a host setting, a DNS record or a snippet of markup
- You want the work done once, not a retainer
- You would rather receive the fix than a document describing it
Not a good fit if
- You want us to log in and make the changes for you — that is a different service and it is not this one
- Nobody on your side can edit DNS, your host’s settings or your page templates
- Your findings are design, copy or strategy problems, which no generated file can fix
- Your site runs on a site builder such as Squarespace, Shopify, Wix or GoDaddy Website Builder: they give owners no way to set security headers, so we decline the order
- Your platform does not permit the change in question
If a file is wrong, it is on us
The guarantee that fits this product is not "we found you three problems" — the audit already did that. It is that every file works. If a file does not apply cleanly, or our re-measure still finds the problem after a correctly applied change, we correct it or refund the pack in full.
Before you pick your host.
Why do you ask where my site is hosted first?
Because the host decides whether the security-header fixes can be applied at all. They are written in your host’s own format, and some platforms, including the site builders Squarespace, Shopify, Wix and GoDaddy Website Builder, give owners no way to set them. Rather than take a request we already know we cannot serve, the host step declines those sites before anything is sent. We then confirm the host from your site’s own response before quoting; if it differs from what you picked, the answer for the real host applies.
Why do you check eligibility before taking payment?
Because in our ten-site dry run, three of the ten sites had nothing we could sell: two no longer responded, and one was a Squarespace site whose only fixable items were security headers that Squarespace gives owners no way to set. Selling those three a Fix Pack would mean taking $599 and then refunding it. The check runs against your live site, costs nothing, and its answer is sometimes that you do not need this.
What happens after I send the request?
We run the eligibility check against your live site and reply with what the pack would contain, what it would not and why, and any fact we need from you: the mailbox for DMARC reports, the phone number to link, the wording for a meta description. Nothing is charged until you have seen that and agreed.
Is there a limit on how many fixes I get?
No. The price is bounded by what the engine can safely generate, not by a count. We tested a seven-fix cap and dropped it, because on sites with more fixable findings it only ever withheld a fix the customer should have had. You get everything we can produce for your site.
Do you need access to my website?
No, and we would rather not have it. No logins, no FTP, no hosting panel, no DNS registrar access. The files are generated from what is publicly observable about your site and the facts you confirm, and handed to you.
Will the files work on my host?
The security-header fixes are written for the platform that serves your site. On WP Engine, Netlify and Vercel they go straight into the host’s own settings or configuration. On Cloudflare, WordPress, Drupal (including on Pantheon), Kinsta, and servers you configure yourself (Apache, LiteSpeed or nginx) they work if one condition holds; the host step names it, and we confirm it with you before you pay. Site builders such as Squarespace, Shopify, Wix and GoDaddy Website Builder give owners no way to set them, so we decline those sites. In our ten-site dry run the header fix could be applied on 5 of the 8 sites that responded, 3 of them only if one condition held, and was not offered on the other 3. The DNS records need access to your domain’s DNS settings, and the markup needs access to your homepage template.
What if a fix does not work when I apply it?
Every file passes our own check before it is sent. When you have applied the pack, tell us and we re-measure the same checks and send a written before and after. If a file is wrong — it does not apply cleanly, or the re-measure still finds the problem after you applied it as written — we correct it or refund that pack in full.
Do I need the $199 audit first?
No. The eligibility check measures your site directly. The audit is broader — it reviews seven areas of your site — while the Fix Pack addresses the subset of findings that can be turned into a file.
Can you just do it for me instead?
Not today. A managed service where we apply the changes on your behalf is a different product with different access, liability and rollback requirements. If that is what you want, say so in your eligibility request — demand is what decides whether it gets built.
Findings are not fixes. This closes the gap.
Tell us where your site is hosted and the page tells you at once whether we can take the order. If we can, the eligibility check is free, and a flat $599 buys every fix we can generate for your site, each checked before it is sent and re-measured after you apply it.
Start with where your site is hostedHost step first · free eligibility check · no access to your systems · no retainer