Skip to content
FREEExternal scan in minutes

Website security for small businesses and storesFind out if your website is intact, and what to do if it is not.

Website security for small businesses and online stores. I check your store or company website from the outside and from the inside: vulnerable modules, exposed files, modified code and malware. You get a clear report with an action plan in order of priority.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only connector
  • No customer data
Sample · fictional store and data

Works with the most widely used platforms

The problem

Websites get infected silently.

You almost never notice the day they get in. Your site keeps loading and selling while someone copies cards at checkout, sends spam from your domain or hides links for others. You find out when Google, the bank or a customer tells you.

  1. 01

    Outdated modules and plugins

    Flaws get published and bots automatically look for sites running that version. It is the most common way in.

  2. 02

    Files that should not be public

    Backups, config files or the .git folder left on the server, downloadable by anyone.

  3. 03

    Modified code nobody reviews

    A small change in a core file is enough to steal payment data while the store keeps working.

  4. 04

    Warnings that come too late

    Blacklists, hosting suspensions or emails landing in spam. By the time they show up, the problem has been there for weeks.

What we check

What we look at, exactly.

Two lists, one for each kind of scan. The one on the left is free right now; the one on the right comes with the report.

From the outside

What anyone on the internet can see

Free

  • Platform and version

    We detect the CMS and the exact core version.

    PrestaShop 8.1.4

  • Modules and plugins with published flaws

    What is visible from outside, matched against vulnerability databases.

    tu_slider 3.1.0

  • Files that should not be public

    Forgotten backups, repositories and config files.

    /backup.zip · /.git/

  • HTTPS and headers

    Certificate, redirects and security headers.

    HSTS · CSP

  • Domain email

    Who can send emails in your name.

    SPF · DKIM · DMARC

  • Reputation

    Whether any service already flags your domain as dangerous.

    blacklists

  • AI-agent readiness

    Whether assistants can read your catalog. Scored separately.

    llms.txt · schema

From the inside

With the read-only connector

Report

  • Core integrity

    Every file, compared with the original of your version.

    classes/Cart.php ≠

  • PHP files where they don't belong

    Scripts in image, cache or upload folders.

    /img/cms/a.php

  • Malware and backdoors

    Obfuscated code, eval, remote loads.

    base64_decode(…)

  • Checkout skimmers

    Scripts that copy card details at checkout.

    checkout.js

  • Full inventory

    Every module and version, disabled ones too.

    42 modules

  • Dangerous configuration

    Debug mode, permissions and admin access.

    _PS_MODE_DEV_

The connector does not read customers, orders or payments, and you uninstall it when we are done. What it does and what it doesn't

The report

A PDF the owner understands and the developer can act on.

A grade from A to F, a plain-language summary and an action plan sorted by urgency: what to do, when and who should do it.

  • Color-coded prioritiesUrgent, important or to improve, with a deadline and who should do it.
  • Concrete evidenceThe exact path, file or version behind every finding.
  • Two versionsFull, with step-by-step fixes, or diagnosis only, to share.

What the PDF includes: cover with the grade · summary for the owner · action plan · findings with evidence · core integrity · inventory of modules and versions · AI-agent readiness · technical appendix.

How it works

Three steps. None of your server passwords.

I do not ask for FTP access or your hosting password. The connector installs like any module or plugin, can only read, and you delete it when we are done.

  1. STEP 01Free

    External scan of your website

    Type the address. In a few minutes you see your grade and the problems visible from the internet.

  2. STEP 025 minutes

    You install the read-only connector

    A module for PrestaShop or a plugin for WordPress. It reads files and versions; it cannot change anything.

    Read files and versionsYes
    Modify or deleteNo
    Customer and order dataNo
    FTP access or passwordsNo

  3. STEP 03PDF

    You get the report and the plan

    You or your developer apply it. If you would rather I fix it, I send you a fixed quote.

The full process, step by step

Pricing

Published prices. No surprises.

Start with the free scan. If you want to go further, you know from the start what it costs.

External scan

Security grade and the problems visible from the internet.

Free

Instant, no sign-up

  • Platform and versions
  • Exposed files
  • Headers, HTTPS and email
Scan now
Recommended

Security report

A full inside check with the connector and a PDF with an action plan.

Business website

€129

Online store: €169

  • Code integrity and malware
  • Full PDF and diagnosis version
  • AI-agent readiness
  • Q&A by email or chat to go through it
Order a report

Hacked website cleanup

I remove the malware, close the way in and check it stays clean.

WordPress

€219

PrestaShop or WooCommerce: €349With priority: +€80 (+€100 for a store)

  • Malware and backdoors
  • Blacklist removal
  • Report of what was done
  • 90-day guarantee
Get help

Maintenance

Updates, continuous monitoring and an alert if anything changes. No lock-in.

Monthly plans
Business website€35 /month
Online store€69 /month

+ Priority add-on: +€25/month, so your issues go first.

  • Regular backups and scans
  • Monthly report
  • Cleanup included if it gets infected
See plans

Prices in euros, excluding VAT. Customers outside the EU can pay in US dollars: see the pricing page.

If you have already been hacked, each platform has its own page: with a hacked WordPress site I start with the backdoors and the database; with a hacked PrestaShop store, with the checkout. If you just want to know where you stand, the website security audit tells you in writing, and for stores PrestaShop security starts with the modules.

To keep it from happening again there is website maintenance: the two plans and their prices, compared. What I do each month depends on the platform, as explained in WordPress maintenance (with WP-CLI) and PrestaShop maintenance (with the support hour).

Jose SorianoFounder of WebIntacta · sorijose.dev
Who is behind it

You talk to me, not to a call center.

I am Jose Soriano, a full-stack developer. I work with PrestaShop and WordPress every day: I am the PrestaShop developer at a PrestaShop Partner agency and I have passed its official course and exam.

WebIntacta is my way of doing it properly: my own tools for an in-depth check, reports people understand and published prices. If I cannot guarantee something, I tell you.

Who answers
Me, the same person who checks your website.
Language and area
English (by email and chat) and Spanish. Worldwide, remotely.
Timing
I tell you how long it will take before starting. I do not promise response times I cannot guarantee.
Lock-in
None. Maintenance can be canceled whenever you like.

More about me

Guides

If you would rather look into it yourself first.

I write guides with what I would do in each case, with the commands for those who are technical and without them for those who are not.

All website security guides

  1. 01How to tell if your website is hackedThe signs you can check yourself, from your phone to Search Console.
  2. 02How to recover a hacked websiteThe order I would do it in, so the infection does not come back.
  3. 03How to upgrade PrestaShop without breaking the storeModules, overrides and theme before you press the button.
  4. 04Which WordPress security plugin to chooseWhat they do, what they don't and why one is enough.
  5. 05What llms.txt is and how to write itThe file that summarizes your site for AI assistants.
  6. 06How much website maintenance costsWhat each price includes and what to ask before signing up.
Questions

What people usually ask me.

Another question? Write to me and I will answer myself.

Does the free scan touch anything on my site?

No. It only looks at what anyone can see from the internet, the way a browser would: pages, headers, certificate, public DNS and whether certain well-known files are exposed. It installs nothing, tries no passwords and sends few requests so it does not load your server.

Why don't you ask for FTP access?

Because a review does not need it, and a server password is the last thing you should be handing out. For the report I use a read-only connector that you install from the WordPress or PrestaShop admin. Only to clean a site will I ask for the access it needs, agreed with you, and it is changed when I finish.

What exactly can the connector see?

Versions, the list of files with their fingerprints to compare them with the originals, the security settings and the admin users. It does not read customers, orders, payments or passwords, cannot change anything and only answers requests signed from my panel. You can uninstall it whenever you like.

My site is already hacked. What do I do first?

Do not delete files blindly: they show how the attacker got in. Make a copy of the site as it is, change the hosting password from a clean computer and write to me marking it as urgent. The steps are on hacked website repair.

What is AI-agent readiness?

A separate score, not counted in the security grade, on whether assistants like ChatGPT, Claude or Perplexity can read and understand your site: robots.txt, llms.txt, structured data. More on AI-agent ready website.

Do you work with websites outside Spain?

Yes, with any country, always remotely. In English, support is by email and chat (no phone calls). Prices are in euros (excluding VAT); customers outside the EU can pay the published US-dollar prices. The invoice is issued from Spain.

Contact

Tell me what you need.

A security report, cleaning an infected site, fixing what your scan found or someone to take care of maintenance. Every message opens a request with its own private link, so nothing gets lost in email threads.

I answer myself, as soon as I can and in order. Anything marked urgent goes first. Support in English is by email and chat.

Support request

Open a request with its own private link

  • Your website address and what you have seen (or what you want to hire)
  • If the site is hacked right now, mark it as urgent and I will read it first
  • I reply with the next steps and, if needed, a fixed quote before touching anything
Write to me

Is your website intact? Check it now.

Free external scan. No sign-up and nothing to install.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only
  • No customer data

Cookie preferences