Performance and Security Services
Two different problems that arrive through the same door: somebody outside the company has told you something is wrong. A customer said the site is slow. An insurer, a client or a procurement process asked a security question you could not answer.
Both start the same way. Measure first. A surprising share of performance work is spent optimising things that were never the bottleneck, because somebody guessed instead of profiling.
We run a fixed-price diagnostic, tell you what is actually wrong in order of impact, and give you the cost of fixing each item. You can act on that with us or with your own team.
What We Do
Not every engagement needs all of this. The diagnostic decides which parts apply.
-
Core Web Vitals
Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift, measured on real user data rather than only in a lab tool. Lab numbers tell you what is possible; field data tells you what is happening.
-
Front-end performance
Asset weight, render-blocking resources, image strategy, font loading and the third-party scripts nobody can remember adding. Usually the cheapest wins on a content site.
-
Backend and query optimisation
Profiling the server, finding the queries doing the damage, indexing, and removing the work that happens on every request for no reason. Most slow applications we are called to have three queries at the centre of it.
-
Caching and delivery
Caching at the right layers, CDN configuration, and cache invalidation that works. Cache strategy is where performance and correctness argue, and getting it wrong shows stale data to customers.
-
Load testing
Testing against the traffic you actually expect, including the campaign spike, so capacity is a measurement rather than a hope.
-
Security review
Dependency and vulnerability scanning, access and permission review, authentication and session handling, secrets management, and the configuration of what is exposed. Reported as specific findings with specific remedies.
-
Hardening
Applying the fixes — patching, configuration, access tightening, headers, rate limiting — and documenting what was changed and why.
-
Answering the questionnaire
The security review that arrived from a client or an insurer. We help you answer it accurately, and fix the things the honest answers reveal.
When Teams
Come to Us
-
The site is slow and it is costing conversions
You can see it in the numbers and nobody is sure which part is responsible.
-
It got slower as it grew
Fine at launch, worse every quarter. Usually a data volume problem rather than a code one.
-
A security review arrived
A client, an insurer or a procurement process is asking, and you need accurate answers rather than optimistic ones.
-
Traffic grew and infrastructure did not
A campaign, a launch, or sustained growth, and the system was sized for an earlier version of the business.
-
Something already happened
A compromise, a defacement, or unexplained behaviour. The order is contain, understand, then harden.
-
A platform deadline
A framework version going out of support, or a dependency with a known vulnerability and no patched path.
Agency Gone Quiet? Get a Free Site Audit
Send us the URL. We will tell you what we find before anyone signs anything — and if the problem is bigger than a quick look can settle, the full diagnostic is a fixed price.
How We Work
What problem you are solving and how you would know it was fixed. A target, not a feeling.
Field data, lab testing, server profiling and dependency scanning. Nothing gets changed at this stage.
What is wrong, in order of impact, each with a cost to fix. This is the deliverable.
Working down the list, measuring after each change rather than at the end, so we know which change did what.
Re-measured against the target that was set at the start.
Monitoring and budgets, so the gains do not quietly erode. See website maintenance.
Stack
- Field data: Core Web Vitals from real users, not only synthetic tests
- Lab testing: Lighthouse and WebPageTest for repeatable comparison
- Server profiling: application and database profiling to find the real cost
- Load testing: against realistic traffic profiles
- Security: dependency and vulnerability scanning, configuration and access review
- Monitoring: uptime, errors and performance budgets, alerting on regression
What the Diagnostic Gives You
- What is actually slow, measured rather than assumed, with the field data behind it
- Findings ordered by impact rather than by how easy they are to fix
- A cost against each fix, so you can decide what is worth doing
- The security findings as specific issues with specific remedies, not a score
- A target to measure against afterwards
- A clear statement of what is already fine
How We
Work Together
-
Fixed-price diagnostic
The usual starting point. A defined scope, a defined deliverable, a fixed number, and a report you own whether or not you go further with us. -
Optimisation project
The work the diagnostic recommends, scoped from the findings and priced per item. -
Incident response and hardening
Where something has already happened. Contain first, then understand, then fix. -
Ongoing
Performance budgets and security monitoring as part of a maintenance arrangement, starting from five hours per month. SeeWe price every engagement individually. There are no packages, because the work does not arrive in packages.
Questions We
Get Asked
-
Not responsibly, no. We can make changes that usually help, and on about a third of the systems we see the actual bottleneck is somewhere nobody expected. Measuring first is cheaper than optimising the wrong thing.
-
Sometimes, and it is the most expensive way to find out. Most slow applications are slow because of a small number of queries or a cache that is not working, and more hardware hides that for a while at a recurring cost.
-
We do a security review — dependencies, configuration, access, authentication and what is exposed — which is what most teams actually need and the thing that finds the common problems. A formal penetration test by a specialist firm is a different exercise, and where you need one we will say so.
-
A score is a proxy. What matters is whether real users experience the site as fast, which is the field data, and whether anything is at risk, which is the security findings. Chasing a number in a lab tool produces work that does not always reach anyone.
-
Fixed price, set from the size of the system and whether it covers performance, security or both. It is deliberately the smallest thing we sell on this page.