Monitoring plans
Scanning is free and stays free. What you pay for is the part a one-off scan cannot do: watching your payment page on a schedule and telling you the day something on it changes. That is also the evidence your payment provider asks for under PCI DSS 11.6.1.
Free
£0 always
One store, checked every week.
- One storefront URL
- Weekly payment-page change detection
- Email alert on any change
- Full scan report, any time you ask for one
Pro
price not set
Daily checks, more stores, and evidence your assessor will accept.
- Multiple storefront URLs
- Daily payment-page change detection
- Slack and Microsoft Teams webhooks
- Monthly PDF for your PCI assessor
- Rescan history and change diffs
Agency
price not set
For the people who look after other people's stores.
- Multiple client domains under one account
- White-label PDF reports
- Bulk rescan across every domain you manage
- Everything in Pro, per client
Vulnerability alerts are free
Verify a domain and we will email you when a flaw is published that affects the line your store was last tested on — on any plan, including no plan at all. One message per flaw, never a newsletter, one click to stop. We do not re-test your store before writing, so the email says when you last tested and asks you to check rather than telling you that you are exposed.
What you pay for is the part an alert cannot do: watching the payment page itself, every day, and telling you the day something on it changes.
Would you rather we just fixed it?
We also do the work. Every item on your report fixed, tested and re-scanned, at a fixed price agreed before we start. Run a scan first — the quote is based on what it finds.
What monitoring does and does not prove
We load the page on a schedule and compare what it serves: added and removed scripts, integrity hashes, and security headers. That supports your PCI DSS 11.6.1 evidence — it shows unauthorised change would be detected and alerted on. It is not the complete mechanism the standard describes, because we reach the page a visitor sees rather than the authenticated payment step behind your cart. We would rather say so than let you find out from an assessor.