You can’t catch what you aren’t looking for.

Plenty of sites have a care plan, a security plugin, or a developer who “keeps an eye on it.” What goes wrong tends to sit in the places habit and routine have trained everyone to look past. A scanner checks what it was built to check. A busy person skims a green dashboard. Nobody asks what isn’t on the list.

So I wrote the list down, made a machine run it every month, and put my name under the result.

Two clients, four real sites, all of them already looked after by a person who knew what they were doing. Across them, the first run turned up:

• the server’s real address was public, so the firewall in front of the site could simply be walked around
• no anti-spoofing records on the domain’s email, so anyone could send mail that looked like it came from the business
• zero of the five standard browser protections switched on
• the site handing out its own login names to anyone who asked, which is half of a password guess

None of it was exotic. A careful human review hadn’t surfaced it, because it wasn’t on the list that review was working from. That’s the point.

WATCH: $49 per site per month.
A mechanized check of your site every month. I read it and I sign it. If I can’t sign it, you get an unattested report instead, which says exactly what’s wrong, what it would take for me to sign again, and a fixed price to fix it. My responsibility covers the truth of the report: what it says is what I saw. It doesn’t cover the whole site, and I won’t pretend it does.

WATCH+ACT: $199 per site per month.
Everything in WATCH, plus a pre-authorized envelope so I can act without waiting for an email chain. Critical patches applied within 48 hours. An active attack blocked. A breaking update rolled back. The site put into maintenance mode if it’s actively compromised. You agree to those four things once, up front, and I’m authorized to do them without asking. The $199 covers up to 2 hours of response a month; unused hours don’t roll over. An active attack or compromise gets contained immediately (blocked, or the site put into maintenance mode), even past those 2 hours. Remediation time beyond them is $130 an hour, and I only bill it with your OK first.

Full care sits above both: updates, backups, edits and a monthly hours budget, quoted by scope. Ask and I’ll send the details. The standing plans are on the care plans page.

A machine report costs next to nothing, so there’s no business in selling one. A human who reads it and puts their name on it is the scarce part, and I couldn’t find anyone selling a signed monthly report at an entry price. The nearest thing I found, Wordfence Care, works out to about $49 a month billed yearly, for one analyst audit a year plus incident response. WATCH is a signed report every month for the same money.