Fix it once: hardening
From US$590, or free with 12 months of Site Care
Everything the free check found, fixed where it can be: headers, Cloudflare in front, login limits, two-step login, accounts, backups. Then a new check.
Norvoya web services · since 2001 · 250+ engineers
Preview: the free check, fixes and plans are open now. The client portal comes later.
Vulnerability monitoring and protection for websites and online stores.
For websites, online stores, web apps and their mobile web versions. AI agents check every day, engineers fix what they find, and you see the status.
Next you add your name and email, so a person can read the result and reply.
- Every finding confirmed by an engineer
- Backups in Canada or the US
- Plans from US$49 a month
Sample report · fictional store
shop-example.com · WooCommerceLast checked 3 hours ago
- HighPayment plugin with a known flawUpdate tested on a copy, applied
- MediumCheckout broken after a theme updateFixed · 1 fix credit used
- MediumNew script on the checkout pageChecked: your new chat widget · noted
- BackupMonthly restore test of the storePassed
Fix credits this month: 1 used, 1 left
Sounds familiar?
A plugin flaw is published, and attackers try it within hours.
Our agents check your site and plugins every day. Updates are tested on a copy first, then applied.
An update breaks the checkout or the contact form, and nobody notices for a week.
We test forms and checkout after every update, on a copy, before customers see it.
Your site is slow, patched by hand and one update away from breaking.
We rebuild it as fast static pages you own. Every edit is previewed before it goes live.
In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of them in plugins. For heavily targeted ones, the median time to first exploit was 5 hours. Source: Patchstack, Feb 2026
Fix it once
Start with the problems the free check found. Fixed price, agreed in writing before we start.
Hacked-site cleanup
From US$490
One site, one cleanup: malware out, access closed, the site back, then a new check. Write with HACKED in the subject and an engineer replies the same business day; on weekends and holidays, the next business day.
Security questionnaire, one deal
From US$490
A customer sent a security questionnaire. We draft the answers from our answer library and your evidence, and mark what is missing.
US dollars, before taxes. The written scope sets the final price. Run the free check first
Care plans, per site or app
Monthly, no setup fee. Agents watch, engineers fix, you get a short report.
Websites and apps
Site Watch
US$49 a month per site or app
No setup fee · minimum 3 months
For sites on Wix, Squarespace or Shopify, where the platform runs the updates. No fix credits
Request a start Free check first
- Daily agent checks: uptime, certificate, security headers, known flaws in the CMS and plugins, malware, broken links
- An engineer checks every alert before it reaches you
- Monthly report
- Small fixes quoted first
Websites and apps
Site Care
US$129 a month per site or app
No setup fee · minimum 3 months
For most small business sites and WooCommerce stores; start here
Request a start Free check first
- Everything in Site Watch
- Updates tested on a copy, then applied
- Forms and checkout tested after every update
- Backups, with a restore test every month
- 2 fixes a month (fix credits), such as a broken form or a plugin conflict
Websites and apps
Site Care Pro
US$299 a month per site or app
No setup fee · minimum 3 months
For sites and stores that change every week: products, menus, listings, events
Request a start Free check first
- Everything in Site Care
- Weekly deeper scan
- Speed and search health
- Up to 10 content changes a month through our agents
- 4 fixes a month (fix credits)
Websites and apps
App Care
US$990 a month per site or app
No setup fee · minimum 3 months
For web apps, SaaS, APIs, headless stores and mobile web versions
Request a start Free check first
- Dependency, API and SDK watch
- A scan on every release, including the mobile web version: keys left in code, old libraries, data sent to third parties
- A public address for vulnerability reports; reports triaged by an engineer within one business day
- 8 fixes a month (fix credits, up to about 30 minutes each)
- One buyer security questionnaire a quarter
Critical plugin or dependency flaw on a site or app we care for: we apply a tested update, or block the attack path, within 24 hours of the advisory, on business days.
Prices in US dollars, before taxes, billed monthly. Minimum 3 months, then month to month; cancel with 30 days' notice. Your site, backups and logins stay yours. Fix credits come with the plan every month and roll over for two months. One credit is one small fix that an agent drafts and tests on a copy and an engineer approves: a plugin conflict, a header, a certificate, a broken form. Bigger work is quoted first.
Your first month
Day 1
You add us as a user on your site and your host. We show you how.
Week 1
First check, first backup, first restore test. You get a short report.
Every month
Updates on a copy, then live. One page: what we checked, what we fixed, what comes next.
Sample report · fictional store
shop-example.com · WooCommerceLast checked 3 hours ago
- HighPayment plugin with a known flawUpdate tested on a copy, applied
- MediumCheckout broken after a theme updateFixed · 1 fix credit used
- MediumNew script on the checkout pageChecked: your new chat widget · noted
- BackupMonthly restore test of the storePassed
Fix credits this month: 1 used, 1 left
Online stores
WooCommerce, Shopify and headless stores. A broken checkout costs sales every hour.
Checkout tested after every update
A plugin or theme update that breaks the cart is caught on a copy, before customers see it.
Payment page scripts watched
We list every script on your checkout and alert you when one changes. Card payment rules expect it: since March 31, 2025, PCI DSS asks payment pages to manage their scripts and detect changes.
Store apps and admin accounts
Plugins and Shopify apps checked for known flaws; admin users and two-step login reviewed every month.
Card data never touches us
Payments stay with your payment provider. We watch the pages around them.
WooCommerce: Site Care or Site Care Pro. Shopify: Site Watch for the store, App Care for a custom or headless storefront.
Source: Bridewell, PCI DSS v4.0 update
Selling software to enterprises
Web apps and SaaS: the buyer's security review decides the deal.
A customer sent a security questionnaire
We draft the answers from our answer library and your evidence, mark what is missing, and do one round of follow-up questions. From US$490 for one deal.
They ask for SOC 2
We prepare the controls and the evidence; the auditor attests. Quoted after a first call on your product and your cloud.
Every release, watched
App Care scans each release, watches your dependencies and APIs, and includes one questionnaire a quarter. US$990 a month.
Mobile web
Most visitors arrive on a phone. Your site and web app should work there first.
Phones first
Layout, tap targets and speed checked on phone screens after every release.
Installable web app
Your site or web app installs from the browser to the home screen, with an offline page. No app store needed.
Same code, same watch
The mobile web version is the same codebase, so it gets the same daily checks and fixes.
We work on websites, web apps and their mobile web versions. We do not build or maintain native iOS or Android apps for now. Check my site
Rebuild your WordPress site as a fast static site
Less to maintain, less to attack. You own every page, and every edit is previewed before it goes live. This site runs the same way.
Fast static pages
No database and no admin login on the public site: less to attack, and pages load fast.
You approve every change
Ask in plain words. An agent drafts the change, you see a preview, and it goes live only when you approve.
Every change kept
Every page and every edit is in a repository you own. Roll back any time.
Forms and integrations kept
Contact forms, CRM links, analytics and redirects move with the site.
Quoted after the free check: we list every page, form and plugin first. A rebuild costs less with 12 months of Site Care or Site Care Pro. Ask for a rebuild quote
Questions owners ask
Who hosts it?
Your account or ours, your choice. Hosting is billed at cost. Pages are served from a global network.
Who owns it?
You own the code, the content and the domain. If you leave, you take the repository and any developer can run it.
Can my team edit pages?
Yes. Ask in plain words by email. An agent drafts the change, you see a preview, and it goes live when you approve.
What happens to plugins?
We list every plugin in the free review. Each one is rebuilt, replaced by a service, or dropped with your approval.
Where do form submissions go?
To your inbox or your CRM, as today.
Online store?
Checkout stays on your store platform. We rebuild the content pages around it.
Which plan after the move?
Site Care for most sites, Site Care Pro if your content changes every week.
How we work on your site
An agent checks your site every day
Uptime, certificate, plugins, malware, forms, broken links.
An engineer looks at every alert
You hear about it only when it matters.
We fix it on a copy first
Then we apply it to the live site.
We check again after the fix
The same check runs until it passes.
You get a short report every month
What we checked, what we fixed, what comes next.
No code to review. If you have a developer, we work with them.
Good to know
Hacked right now?
Write to hello@norvoya.com with HACKED in the subject. An engineer replies the same business day; on weekends and holidays, the next business day. Cleanup is a fixed price, agreed before we start.
On Wix, Squarespace or Shopify?
The platform updates its own system. Site Watch still checks uptime, your domain, certificate, forms, apps and broken links. Want to own your site instead? We rebuild it as fast static pages you own.
Do I need a developer?
No. You add us as a user on your site and your host, and we show you how. If you have a developer, we work with them.
Who sees my site and data?
Engineers on your plan only, under NDA, with access logged. Backups stay in Canada or the US.
What we commit to
- Written scope before work starts.
- Every deliverable dated and kept in your evidence file.
- Vulnerability reports acknowledged within one business day; on Respond and Secure, received 24/7 with an engineer on call.
- A first answer to any request within one business day, Vancouver time.
- A named lead you can escalate to.
You own your product and its security. We own the work we deliver, in writing. No one can promise a site or product will never be hacked. Doing nothing is far riskier. We shorten the time you stay exposed, and we keep the record.
Start with the free check.
A grade from A to F in under a minute, and a plain list of what to fix. A person reads every check and replies within one business day.