Vitrine
A plain-language review of your public website.
We review your public website from the outside: a handful of ordinary page requests, a few standard files (security.txt, robots.txt, the sitemap, one address that cannot exist) and the public records of your domain. No login, no account created, no form submitted, nothing changed. We assess the results against fixed rules. You receive a one-page summary and a report in plain language that say what matters, what is in your own hands and what belongs to your platform (Wix, Squarespace, WordPress, Shopify, your agency’s build), so no one wastes time chasing the wrong problem.
Is a review right for me?
Ten questions an owner can ask about a public website. If you cannot answer one with confidence, a review shows you what anyone outside can already see.
Can your customers trust the padlock?
Free review: 18 of 23 situations · Check-up: +1 · not built yet: 1 · not checked, by design: 3
Can someone pretend to be you?
Free review: 19 of 21 situations · Check-up: +1 · not checked, by design: 1
Will your site still be there tomorrow?
Free review: 9 of 20 situations · Check-up: +7 · not checked, by design: 4
What software is your site made of, and is it known to be broken?
Free review: 22 of 26 situations · awaiting the contract: 1 · not built yet: 2 · not checked, by design: 1
WordPress in depth: core, plugins and themes
Free review: 17 of 21 situations · Check-up: +1 · not checked, by design: 3
Who else runs code on your page?
Free review: 14 of 22 situations · not built yet: 4 · not checked, by design: 4
What information is your site exposing?
Free review: 23 of 28 situations · not checked, by design: 5
Does your site show what the law asks for?
Free review: 11 of 17 situations · Check-up: +1 · not built yet: 2 · not checked, by design: 3
Can everyone use it?
Free review: 1 of 15 situations · Check-up: +2 · kept in the record, not reported: 3 · not checked, by design: 9
What we won’t tell you, and what we don’t do
Free review: 10 of 27 situations · Check-up: +1 · not checked, by design: 16
What each plan includes
| Plan | What you get | Price |
|---|---|---|
| Free review | You ask, in writing. Within three business days: your one-page next steps, the report, and a step-by-step guide your web person can follow. | Free |
| Check-up (Bilan de vitrine) | The report, the step-by-step guide, a 30-minute call to walk through it, and a second review after your fixes, within 60 days, that says what changed. | $350 CAD, one-time |
| Watch (Veille), four reviews a year | Four reviews a year, each with the difference from the last, including your certificate’s expiry date and the contact data your pages print. For now, each review is scheduled by hand. | $480 CAD per year |
Prices in Canadian dollars, taxes extra.
How it works, in five steps
- You ask in writing: an email from an address on your site’s domain (or the one your site publishes), our one-page form, signed, or the free review button below. Nothing is checked before that.
- For a paid plan you also prove the site is yours: a small DNS record or a tiny file we give you, two minutes for your technician. The review starts only after we’ve confirmed that proof.
- The review: at most nine ordinary requests per host name, thirteen if you tick the linked-pages box (your login, account, cart or contact pages and your privacy page, read and never submitted), the way a browser makes them. Your logs will show a single visitor, named in your report.
- The report: a one-page summary on top, then the items in plain language (English or French, your choice), ranked by what matters. Every item cites the standard it is based on. No jargon, no scare tactics, no score.
- The call, the fixes, the second review. Then, if you wish, four reviews a year.
The rules we work by
- We review only sites whose owner asked in writing; for a paid plan the owner also proves control. Never anyone else’s.
- We never log in, create an account, submit a form, send data, attempt an exploit or try to get past any control.
- Your report is yours. We keep one copy for twelve months and publish nothing about your site. Who else sees it (the account manager gets your one-page summary only; an AI service proofreads it) is in our privacy notice.
- No certification, no guarantee, no “your site is secure”: an honest observation of a given day, and what to do about it.
- A signed service contract and a privacy notice before any paid work. No cold calls, no mass emails.
- If an account manager introduced us, they earn a commission on what you pay.
Who it’s for
A small business or professional practice anywhere in Canada whose public website brings in clients: clinics and practitioners, shops, trades, consultants, small manufacturers, associations.
Not for: government bodies, sites you do not control, or anyone who wants us to try to break in.
Request your free website review
Two minutes, nothing to pay, no card: your email, your business, your site address and your yes. Use the email address your site publishes, or one on your domain; nothing is checked before your written request.
Request your free website reviewOr write to [email protected] in your own words.
What’s being exploited now, in website software we recognize: What’s being exploited now.
What a report looks like: an example for a fictional clinic · Documentation and support.
The rules behind every review are on our security page: how we review systems.