Ryvx

When a client site goes live with a hole in it, the client calls the agency. A short, repeatable security routine before launch protects them and you, and it gives your clients a straight answer when they ask whether the site was tested.

The free checks to run every time

Run SSL Labs against the live domain to check the certificate and HTTPS setup. Run securityheaders.com to check the headers that stop clickjacking and injected scripts. Run OWASP ZAP's automated scan against the staging site. On WordPress, run WPScan for known plugin and theme problems. Then check by hand that no backups, database exports or version-control folders are reachable from the web, and that every admin account has two-step login.

These tools find configuration problems well. None of them signs in as a customer and tries to read another customer's data, abuse a checkout or get round a login, and those are the problems that cause real damage.

When a site needs a proper test

Bring in a real test when the site has logins, takes payments, stores customer data, has an API, or has a chatbot. Those are the parts automated scanners cannot judge.

How Ryvx works with agencies

A Ryvx Launch Security Review is £495 per site, a fixed price you can quote to a client up front. Our AI testing tools test the site the way an attacker would, every finding comes with working proof, and a person checks the report before it goes out. The report arrives in 3 to 5 working days, with a plain summary your client can read and fixes your developers can act on, plus one retest after the fixes.

Agencies and IT support firms can join the Ryvx partner programme: introduce a client, Ryvx runs and reports the test, and you keep 20% of what that client pays for as long as they stay. The client must own the site and agree the scope in writing before anything is tested.