Agree what may be tested
We list addresses, environments, test accounts and audit boundaries.
Test the agreed journey
We review the UI, API, payment, message delivery, data storage, logs, release and restore path.
Deliver a decision-ready result
Each item includes evidence, risk, recommendation and a retest method.
Quick URL audit
50 PLN. A first measurement of a public page. 1 public URL · sample of up to 30 links We check speed on phones and computers, public HTML, HTTP headers, robots.txt, the sitemap and links from the tested page. Lighthouse results and real-user CrUX data are shown separately when available. No expert review, authentication, payments or infrastructure. Online report and email link: confirmed findings, missing measurements, evidence, priorities and retest guidance. Print/PDF and data export. Starts automatically after payment confirmation; usually a few minutes. Provider limits and retries can extend processing. The report describes the measurement time. A new automatic measurement after changes requires a separate order.
Expert website audit
1,990 PLN. For an expert assessment of public pages. 1 domain · up to 10 URLs · 3 templates · 1 language Technical SEO, crawlability, performance, responsiveness, navigation, contact form and basic keyboard accessibility. Up to 10 public URLs and 3 page templates. Excludes private accounts, payment flows and infrastructure review. Evidence-based report and remediation plan, P0–P3 priorities and indicative effort. A 45-minute results meeting. Within 5 working days after scope agreement and access provision. One retest of reported findings within 14 days of the report, up to 2 hours of work.
Application and payments audit
4,490 PLN. For risks in user journeys and integrations. 1 application · 2 roles · 5 journeys · 1 payment provider One application and test environment. Up to 2 roles and 5 agreed journeys, such as login, order, payment, webhook, report/email. Errors, cancellation, duplicates and retries in these journeys. One payment provider. Controlled tests in an agreed environment. Infrastructure and penetration testing are separate. Technical report, scenario matrix with results, evidence and remediation plan. A 60-minute results meeting. Within 7 working days after complete access and test data are supplied. One retest of reported findings within 14 days of the report, up to 3 hours of work.
Infrastructure and reliability audit
6,490 PLN. For configuration and operational continuity checks. 1 environment · up to 3 services · 1 database Review of releases, access configuration, secrets, updates, logs and alerts. Controlled recovery of one database backup and rollback procedure verification. Up to 3 application services and 1 database in one environment. Excludes UX, payment journeys and any unagreed penetration testing. Risk and recommendations report, recovery record and recovery/rollback plan. A 60-minute results meeting. Within 10 working days after access and safe test procedures are agreed. One retest of reported findings within 14 days of the report, up to 3 hours of work.
Final prices in PLN. The report is included.
Expert packages start after scope and access are confirmed. Contact buttons do not charge a card. Prices exclude fixes, deployment, ongoing monitoring, full penetration testing, formal WCAG or legal compliance certification and provider fees. Any additional cost requires approval before work. Retests cover original findings within the stated time limit. New features, another language, expanded scope or new infrastructure require a separate quote. Payment tests use the provider’s sandbox. Live transactions or recovery affecting production require a separate agreement. Reports include date, resources, method, limitations, evidence, impact, recommendation and acceptance criteria. Missing measurements are disclosed, not invented. The automatic audit does not certify application security, Google rankings or authenticated purchases.
FAQ
What does the automatic scan check, and what needs an expert audit?
The PLN 50 scan checks one public URL: mobile and desktop Lighthouse measurements, public HTML, selected HTTP headers, robots.txt, a sitemap and a sample of up to 30 links. It does not sign in, buy anything or read source code. Code, permissions, payments, integrations and system recovery require an expert audit with agreed access and scenarios.
What does a partial result mean, and how are fixes verified?
If a measurement source is unavailable or a site blocks access, the report lists the missing data. It does not mark those checks as passed or issue a full score from incomplete measurements. Findings include evidence, priorities and a retest method. Remediation is agreed separately; retest terms depend on the selected package.
What do P0–P3 priorities mean?
P0 is an urgent blocker, P1 a high priority, P2 a planned correction and P3 a further improvement. The order follows evidence and impact within the checked scope. Missing measurements are listed separately; they are not confirmed faults. A priority is not a quote or delivery promise.
Is this a penetration test?
Not automatically. A penetration test requires separate authorization, scope, rules of engagement and a testing window.
Does an audit prove complete security?
No honest audit can guarantee that no vulnerability exists. We confirm the performed controls and state all limitations.
Do you test payment gateways?
Yes. Scope may cover checkout, redirects, webhook signatures, amount and currency checks, idempotency, retries, duplicates, order status and refunds. We do not ask for card data.
Can the audit disrupt production?
We start with non-invasive checks. Active tests are separately approved and can be stopped immediately.
What will I receive?
The report records the measurement date and scope, results, evidence and P0–P3 actions. Each item explains its impact, recommendation and how to verify a fix. Missing measurements are listed separately. The automatic audit includes an online report, print/PDF and JSON data; expert packages also include a results meeting and a retest within the published limits.
Can you implement the fixes?
Yes, as a separate scope and decision. The audit remains useful regardless of who performs the remediation.