Services and pricing
Every engagement starts with a fixed-price assessment of the environment as it is. Fixes are a separate engagement, quoted in writing after you have read the findings.
Assessments compared
| Service | Scope | Price (USD) | Production changes |
|---|---|---|---|
| PHP response assessment | One server, up to five sites | $499, one-time | None |
| Agency portfolio assessment | Up to five servers and 25 sites | $1,999, one-time | None |
| Legacy compatibility assessment | One application | $999, one-time | None |
| Remediation | Written scope agreed after an assessment | From $2,499 | Only as approved in writing |
PHP response assessment
One server, up to five sites
$499USD, one-time
Start assessmentWho it is for
A business or site owner with one PHP server who needs to know whether PHP2Shell and related advisories affect it, and what fixing it involves.
What is reviewed
- The SAPI and PHP runtime serving each site: PHP-FPM pool, Apache module or CGI handler
- Where each runtime comes from: distribution package, third-party repository or source build
- Vendor advisories and backported fixes for that package source
- Whether the workers serving traffic were restarted after the last update
- Branch support status and the upgrade path for each runtime
- Web server and PHP configurations targeted by past PHP advisories
What you receive
- Written findings in your dashboard, prioritized by severity
- A runtime inventory for each site in scope
- Remaining unknowns, each with the question or evidence that would settle it
- A proposed remediation scope with a written quote
Limits
Covers one server and up to five sites. Ubuntu and Debian servers are accepted now; Docker, managed hosting and other environments are reviewed case by case before acceptance.
Not included
- Production changes, package updates or restarts
- Containment or investigation of a suspected compromise
- A guarantee that any system is secure
- Application migrations or code changes
Agency portfolio assessment
Up to five servers and 25 sites
$1,999USD, one-time
Assess a portfolioWho it is for
Web agencies and managed IT providers responsible for many client sites, who need one prioritized view of where to act first.
What is reviewed
- Everything in the PHP response assessment, for every server and site in scope
- Which client sites share a server, a PHP-FPM pool or a package source
- Sites on end-of-life branches that need a separate migration decision
- Gaps in the inventory itself, such as staging copies and containers that run PHP
What you receive
- One inventory across all servers and sites, grouped by client
- Findings prioritized across the whole portfolio, not server by server
- Patch status and remaining unknowns for each site
- A written remediation scope, which can be phased by server or client
Limits
Covers up to five servers and 25 sites. Larger estates are scoped individually; write to us before purchasing.
Not included
- Production changes, package updates or restarts
- Containment or investigation of a suspected compromise
- A guarantee that any system is secure
- Application migrations or code changes
Legacy compatibility assessment
One application
$999USD, one-time
Assess a legacy applicationWho it is for
Owners of an older application on an end-of-life PHP branch, where moving to a supported branch may need code or dependency changes.
What is reviewed
- The current PHP branch, its support status and any available vendor or source backports
- Application compatibility with a supported PHP branch
- Composer dependencies, frameworks and extensions that constrain the upgrade
- Interim options while a migration is planned, and their limits
What you receive
- Compatibility and dependency findings
- Migration risks, ordered by impact
- A recommended path and next steps
- A separately priced remediation plan for the engineering work
Limits
Covers one application. The assessment establishes what a migration involves; the engineering itself is quoted separately.
Not included
- Production changes, package updates or restarts
- Containment or investigation of a suspected compromise
- A guarantee that any system is secure
- Code changes and migrations, which are quoted separately
Remediation
A separate engagement, quoted after an assessment
From $2,499USD, quoted per written scope
Remediation is the work of actually fixing what the assessment found. It is never bundled into an assessment, and nothing is changed in production until you have approved a written scope and paid for it.
What the written scope sets out
- The exact changes, packages and versions, and the sites and servers they affect
- The maintenance window and how the change is staged
- The application journeys checked before and after, such as login, checkout and uploads
- The recovery route if a check fails
- The price, with your assessment fee credited once
Before any production change
- Access is agreed separately and limited to what the scope needs
- A maintenance window is agreed in writing
- A backup and a recovery route are confirmed to work
What you receive
- A record of the changes deployed and the checks run
- Evidence of the runtime serving each site after the change, including worker restarts
- Anything left unresolved, with an owner and a recommended next step
Standard remediation starts at $2,499. Legacy changes and larger portfolios are scoped individually. If we find signs of compromise, patch work stops and the situation is handled as incident response; see suspected compromise.
Recurring patching
In development
Not yet available to purchaseWe are building a recurring service that applies routine PHP security updates under a maintenance policy you set, with the same evidence as a remediation job. It is not available yet, and we are not taking payment for it.
What it is designed to cover first
Supported PHP-FPM environments on Ubuntu and Debian, with package sources and release combinations we have tested. Other platforms, such as Docker and managed hosting, are planned later.
What it will require
- Narrowly scoped, authorized access set up during onboarding, never emailed keys
- An explicit maintenance policy stating which changes may run without a further approval
- A backup and recovery mechanism that has been tested before the first change
- Application checks meaningful enough to detect a broken deployment
What it will not do
Major or minor version migrations, dependency replacement, destructive database work and anything involving suspected compromise will stop the routine job and be escalated to you. Until recurring patching is available, eligibility and delivery are reviewed individually after an assessment.
To discuss whether your environment would be a fit, use the contact form.
Start with an assessment
Intake is currently limited to PHP on Ubuntu and Debian servers; other environments are reviewed case by case. Online checkout opens once payment setup and delivery capacity are confirmed. Read the service terms before you start.