Straight answers about cyber health checks and secure websites.

We agree the scope in writing, then work through the areas you have approved: email and account access, multi-factor sign-in, devices and updates, backups and whether recovery has been tested, your website and its forms, and how customer information is handled. You get a plain-language summary of what is working, what needs attention, and a sensible order to tackle it in. Nothing is tested without your written permission.

Most small businesses need one short conversation to agree the scope, then a review that runs in the background, then a walk-through of the findings. Your time is mostly in the first and last of those. The exact length depends on how many systems and people are involved, which is agreed before anything starts.

Work is quoted per business rather than sold from a price list, because a sole trader with one laptop and a 30-person firm with a web application are not the same job. You get a written quote covering scope, deliverables and exclusions before any work begins, and there is no charge for the initial conversation.

Both, and they overlap more than people expect. Websites, online shops, web applications, desktop software, automation and integrations are all built here, with the security considered during the build rather than bolted on afterwards. Every service has its own page under Services.

Often not the one people ask for. If the problem is one repetitive job eating hours a week, automation usually solves it for a fraction of the cost of a full system. Describe what is going wrong and how it is handled now, and you will get a straight recommendation, including when the answer is something smaller than you expected.

Websites start from £395 for a small site, with most small business sites landing between £685 and £985. Every service page shows its own starting price. You get a fixed written quotation before any work begins.

No. A Cyber Health Check is a review, not an attack. We look at configuration, settings and process, and we only ever look at what you have authorised in writing. Full penetration testing is a separate, specialist engagement and is not part of this service.

No. Certification has to come from a licensed certification body, and GSKordeven is not one. What we can do is help you understand where you currently stand against the kind of controls Cyber Essentials asks about, so that if you do go for certification later you are not starting cold. We will never describe you as certified when you are not.

Either. Some clients take the action plan to their existing IT provider, some ask us to carry out the improvements, and some do the easy items themselves and hand over the rest. The report is written so it is useful whichever route you choose.

A website presents information: pages someone reads. A web application is software people sign in to and use to get work done, such as a booking system or a customer portal. The two are priced very differently, so it is worth being clear which you need.

Desktop if it runs in one place and needs to work without internet. Web if people need it from several locations or from a phone. There is no reason here to push one over the other, so you will get an honest recommendation once the way you work is clear.

No. A website security review looks at one website: its configuration, its software, its forms and what it exposes. A cyber health check looks at the business: accounts, email, devices, backups and access. Plenty of businesses want both, but they answer different questions.

No, and it is not meant to. Day-to-day IT support and an independent look at cyber risk are different jobs, and it is often healthier when they are not the same person. The findings are written so your existing provider can act on them directly.

Most attacks are not aimed at anyone in particular. They look for whatever is easiest to get into: a reused password, a missing second sign-in check, software that stopped being updated, an old administrator account nobody closed. Being small does not keep you off that list, and the UK government's own breach survey finds incidents across every business size.

GSKordeven is based in Scotland and works with businesses across the United Kingdom. Reviews, websites and applications are all delivered remotely, so location rarely affects the work.

Yes, from £995. Product catalogue, cart, checkout, payment provider integration, delivery options, click and collect and order management. Card details are handled by the payment provider rather than stored on the website, which is both safer and simpler.

Usually, if that software offers an API, which most modern business software does. Whether it is possible gets checked before anything is quoted rather than discovered halfway through.

Yes. It can be given a knowledge base about your business so it answers about what you actually do. It runs server side so the key is never exposed to a browser, and usage limits are set so the running cost stays predictable. The assistant on this website is the same thing.

If you want it. Website Care covers hosting, updates, backups, security checks, monitoring and small changes for a fixed monthly cost. It is optional, and you own the website either way.

It is used to do the work you have asked for and nothing else. Enquiries are kept in a restricted area of the website and in the business mailbox, are never published, and are reviewed for deletion once they are no longer needed. The Privacy Policy sets out the detail, including retention periods and your rights.

No, and please do not send them through the enquiry form. If a piece of work genuinely needs access later, an appropriate method and a clear scope are agreed first. The form deliberately refuses anything that looks like a password, key, token or card number.

No, and neither will the enquiry form. Passwords, PINs, API keys, recovery codes and authentication tokens should never be sent through any web form. Where access is genuinely needed for a piece of work, a secure method is agreed first.

No website or application can ever be guaranteed completely secure, and anyone who promises that is overselling. What can be done is to remove avoidable weaknesses, limit access, protect the information you hold, keep software supported and make sure recovery is possible when something does go wrong.

Search Console is set up, a sitemap is submitted and indexing is requested for the pages that matter, and the site is structured so Google can read it. Nobody can guarantee a ranking position, and you should be wary of anyone who does.

Yes. The domain, the website, the content and the business data are yours. If you ever move elsewhere it goes with you under the agreed terms.