I review, fix, document, and monitor the basic technical points that are usually left unattended after a site goes live: security headers, HTTPS, DNS, forms, Search Console, visible errors, and small operational improvements.
All deliverables are in English. You get the technical depth of a seasoned developer at a fraction of the cost of a local consultant.
No scaremongering. No promises of total security. Just clear technical review, verifiable fixes, and a before/after report.
Many companies have a website, corporate email, forms, hosting, DNS, Analytics, Search Console, plugins, and landing pages. Once the site is published, no one is usually left checking whether any of that still works properly.
The certificate expires, a form stops sending emails, indexing errors appear, security headers go unconfigured, and the site starts showing signs of technical neglect. It doesn't always justify hiring someone internally to watch it — but leaving it completely unattended isn't a good option either.
Ignoring technical maintenance costs little until something fails. Reviewing it periodically costs far less than improvising under pressure, losing form submissions for weeks, or discovering late that a critical configuration was broken all along.
Tooltician offers a lightweight layer of review, hardening, documentation, and monitoring for companies that need to keep their site technically sound — but don't have enough volume to justify hiring a developer, web administrator, or internal specialist.
No scaremongering. No promises of total security.
Many automated tools generate low scores for reasonable configurations or deliberate trade-offs. Tooltician doesn't sell manufactured urgency: I review the basics, separate urgent issues from noise, fix what's reasonable, and document what was done with verifiable evidence.
SecurityHeaders.com and Mozilla Observatory serve as a visible starting point, not a final verdict. The reading considers context, available access, site criticality, and the real cost of correction.
Tools as evidence, not as a complete diagnosis
I use SecurityHeaders.com, Mozilla Observatory, Search Console, DNS review, form testing, and hosting signals as starting points. The final reading accounts for context, available access, site criticality, and reasonable correction cost.
Want a quick first signal?
Enter your domain at SecurityHeaders.com and Mozilla Observatory. A score of C or below generally indicates pending basic configurations. The technical diagnostic uses those results as a starting point, contextualizes them with the rest of the site, and separates what's urgent from automated noise.
The first step is designed to be lightweight and concrete: look at what's visible, separate useful signals from automated noise, and leave an understandable path to correction.
I surface visible signals without requesting access: headers, HTTPS, redirects, DNS, sitemap, robots.txt, visible forms, and public tools.
I sort findings by operational impact, correction difficulty, and reasonable urgency — avoiding dramatizing automated scores.
When permissions are available, I apply agreed fixes in hosting, CMS, CDN, DNS, repository, or the relevant provider.
I leave screenshots, review date, checklist, and technical notes so the change is verifiable and transferable.
I recommend closing, implementing a second phase, or moving to monthly review based on what the site actually needs.
The natural entry point is the Diagnostic ($69, credited toward implementation). Most simple sites scale to Basic Hardening. When the site drives leads, reputation, or sales, the Full Review closes better at just $100 more than the operational plan — and delivers the executive report and roadmap that open the path to monthly support.
| $69 Web Technical Diagnostic | From $499 Basic Web Hardening | From $899 Operational Review & Hardening | From $999 Full Review with Executive Report Recommended | From $279/mo Monthly Technical Web Support | |
|---|---|---|---|---|---|
| External diagnostic | ✓ | ✓ | ✓ | ✓ | — |
| Header hardening + canonical HTTPS | — | ✓ | ✓ | ✓ | — |
| Form, DNS & email auth review | — | — | ✓ | ✓ | — |
| Technical report / notes for the admin | ✓ | ✓ | ✓ | ✓ | ✓ |
| Before/after evidence with screenshots | — | — | — | ✓ | — |
| Executive report in business language | — | — | — | ✓ | — |
| Monthly monitoring roadmap | — | — | — | ✓ | ✓ |
| Monthly monitoring + periodic fixes | — | — | — | — | ✓ |
$69
one-time
To know exactly what is technically neglected before paying for fixes.
Applied as a credit toward any implementation plan.
From $499
one-time
To fix the obvious and leave the site technically cleaner, with a verifiable record for the administrator.
For simple or corporate sites with no executive deliverable requirement.
From $899
one-time
For sites that need full hardening and operational review, with no deliverable required for management.
Covers the technical. No executive report or follow-up roadmap.
From $999
one-time
When the result needs to be presentable to non-technical stakeholders without translation, with full evidence and a roadmap for the next month.
Recommended for sites that drive leads, reputation, or sales.
From $279/mo
per month
To maintain what was fixed and have external technical judgment reviewing the basics regularly.
Natural continuation of the Full Review. No in-house hiring needed.
Prices in USD for clients in the United States, Canada, the United Kingdom, Europe, and other international markets. All deliverables — reports, checklists, and documentation — are produced in English and structured for direct handoff to non-technical stakeholders. For clients in Chile and Latin America, this service is available in Spanish at local rates (UF/CLP) — see the Spanish version.
A platform freelancer can fix what you ask for. Tooltician reviews what you didn't know to ask about.
Generic freelancer
Tooltician
The real difference
Tooltician already builds automations, internal APIs, ETL pipelines, and production sites with handoff-ready documentation. This service applies the same logic to the day-to-day technical operation of published sites: judgment, evidence, and continuity — not just task execution.
Own technical proof
Tooltician applies these same practices to its own site: canonical HTTPS, fully configured email authentication (SPF, DKIM, DMARC), active security headers, and no uncontrolled external dependencies. The code is public and auditable.
Built for production sites that matter commercially but were left without a technical owner after the initial launch.
The site works, but no one is regularly checking plugins, forms, headers, backups, or Search Console.
The agency designs and publishes sites but does not want to burden its team with low-margin recurring technical maintenance.
The site receives leads. If the form fails or the technical signal degrades, the loss arrives before anyone notices.
The web presence is part of the reputation or sales channel — a visible technical lapse reduces trust without needing a major incident. Needs HTTPS, forms, errors, DNS, and basic signals checked without adding a full hire.
Related projects
It's a layer of web hygiene and basic hardening. It does not replace pentesting, compliance, or a deep security audit.
It means some security headers expected by modern browsers are missing. It does not automatically mean the site is compromised.
No. Anyone serious should not promise total security. I can fix visible configurations, document improvements, and reduce reasonable oversights.
Yes, but the scope depends on hosting, plugins, available permissions, and the general state of the site.
Yes. In many cases hardening is resolved in hosting, CDN, server rules, or framework headers.
For external diagnostic, not necessarily. For corrections, controlled access to hosting, CMS, repository, DNS, or the relevant provider is required.
I report it with priority, propose a course of action, and if it exceeds the scope, I recommend escalating to a specialist or a deeper audit.
It can happen, especially with well-maintained sites. In that case the report confirms it with evidence — knowing the basics are solid is also valuable before changing hosting, launching a campaign, or delegating the site to a third party. The diagnostic fee applies regardless, but there are no surprises or additional charges.
No. The scope is defined by the contracted plan. If something beyond that scope appears during the review, it is documented in the report with a recommended next step — but not executed without prior agreement.
A US or EU technical consultant typically bills $100–150/hour. The Full Review at $999 is the equivalent of 7–10 hours — with an executive-ready report delivered, not just a call. All deliverables are in English.
The Spanish-language version is calibrated for the Chilean and Latin American market: different currency, different purchasing power, and documentation delivered in Spanish. The international service is priced in USD, delivered entirely in English, and structured to meet the expectations of clients in the US, UK, and European markets — including executive-ready deliverables and formal documentation standards. The technical scope is equivalent; the context of delivery is not.
Yes. If your site is in English and you need deliverables in English, the international rates apply regardless of your language preference. If you prefer Spanish documentation and local pricing, the Spanish version of this service is the right entry point — same technical scope, calibrated for that market.
If your site is already live and you want to know what's technically neglected, the right entry point is a brief, verifiable diagnostic.
Initial external review with a prioritized findings report and a clear next step. The cost is credited toward any implementation plan. No-commitment entry point.
If the diagnostic finds nothing actionable, the report confirms it with evidence — knowing the basics are solid is also valuable before changing hosting, launching a campaign, or delegating the site to a third party. The fee applies regardless, but there are no surprises or additional charges.
If you arrived here from an observation about headers, forms, DNS, Search Console, or visible signs of incomplete maintenance — the scope is this: review, fix what's reasonable, and leave clear evidence. This is not a deep security audit or a promise of total security.