Independent
I do not resell hardware, licences or support contracts. My advice has no sales motive. If the fix is "do nothing", I say so.
Independent infrastructure & security audits
Ten years of running servers.
I know where they break.
I go through your whole setup, look at everything, and tell you in plain English what is unsafe, what is slow, and what is costing you money. Then, if you want, I fix it.
- Fixed price, agreed first
- No product to sell you
- A report you can read in 10 minutes
0+years in commercial web hosting and server admin
£0fixed price for a small-office health check
0licences, kit or contracts I earn commission on
0 minto read the owner's summary of your report
Why hire me
One person who has seen it all break, on your side.
Most small firms have nobody to check their IT. If they have a supplier, that supplier marks its own homework. I am the independent second pair of eyes.
Fixed price, before I start
You get a written scope and a fixed quote. No meter running, no surprise invoice. Extra work needs your yes first.
Plain English
A one-page summary for the owner, a risk-ranked findings list for the techies, and a costed fix plan for both.
Hands on, not just a report
I have patched, rebuilt and migrated servers for a living. I can fix what I find, or brief your supplier so they can.
From DNS to hypervisor
Domains, mail, web servers, databases, operating systems, networks and virtualisation clusters. The whole stack, one person.
Real incident experience
Years of hacked customer sites on shared hosting: web shells, reverse shells, crypto miners and spam scripts. I know what to look for.
What I check
Every layer, scaled to the size of your business.
Pick an area to see what goes under the lens.
Servers & operating systems
Old systems are the most common way in. I find every machine past its support date and every patch you have missed.
- End-of-life operating systems: old Debian, Ubuntu, CentOS, Windows Server
- Patch backlog and how updates get applied, if at all
- Known vulnerabilities in installed packages
- Disk, RAID and hardware health, capacity headroom
- SSH config, sudo rights, exposed services
- Logging, monitoring and alerting: would you even notice?
Web servers, PHP & databases
My home turf. Most slow sites are a config problem, not a hardware problem.
- nginx, Apache or LiteSpeed config, caching and compression
- PHP-FPM pool sizing, PHP versions and their support dates
- MySQL or MariaDB tuning: buffer pool, slow queries, indexes
- TLS versions, certificates and auto-renewal
- File permissions and writable folders attackers love
- WordPress, Magento and other CMS plugin risks
Network & firewall
What can the internet see, and what can talk to what inside your walls?
- Router and firewall rules, open ports from the outside
- Firmware age on routers, switches and access points
- Segmentation: guests, staff, servers and cameras apart
- Wi-Fi security and VPN setup
- Single points of failure in links and kit
- Slow links and bottlenecks
Virtualisation & clusters
Proxmox, VMware vSphere and Ganeti. One bad host should never take the business down.
- Hypervisor versions and their support dates
- Cluster quorum, fencing and failover that actually works
- Storage layout, replication and snapshot sprawl
- Over-committed memory and CPU
- Management interfaces exposed where they should not be
- Backups of VMs, and a restore test
Domains, DNS & email
Lose a domain and you lose your website and your email in one go. It happens more than you think.
- Domain ownership, renewal dates and registrar locks
- DNS records: stale, dangling or pointing at old servers
- SPF, DKIM and DMARC, so nobody can send as you
- Cloudflare setup: proxying, WAF rules, caching
- Who holds the logins, and is two-factor on?
- Mail delivery problems and blocklist checks
Accounts & access
Leavers who still have logins. Shared admin passwords. One phished account with the keys to everything.
- Microsoft 365 or Google Workspace setup
- Multi-factor sign-in coverage
- Stale accounts and old staff logins
- Admin roles: who has them and why
- Supplier and remote access
- Password and joiner-leaver process
Backups & data
A backup nobody has restored is a hope, not a backup. I test one with you.
- What gets backed up, how often, and where to
- An off-site copy that ransomware cannot reach
- A real test restore
- File share permissions
- Retention and how long you could go back
- A plan for the day the main server dies
Automation & infrastructure as code
If one person's memory is the only build guide, that is a risk. Code makes it repeatable.
- Ansible playbooks and roles: idempotent, tidy, safe
- Terraform state, secrets and drift
- Secrets in git repositories
- Repeatable server builds
- Patch and deploy pipelines
- Documentation that matches reality
Free self-check
Ten questions. Two minutes. No sign-up.
Tick each line that is true for your business. If you are not sure, leave it unticked: "not sure" is a finding too. Nothing you tick leaves your browser.
Think you have been hacked?
I find what they left behind, and close the door they used.
A site redirecting to spam. A server at 100% CPU for no reason. Mail bouncing because your IP is on a blocklist. I have spent years cleaning up compromised sites and servers in commercial hosting. Deleting the obvious file is not enough: attackers leave back doors, and they come back the same way they got in.
Before you email me
- Do not delete anything yet. The files and logs show how they got in.
- Change your passwords from a device you trust, starting with email and the hosting account.
- Take the site offline if it is harming visitors, but leave the server running so the evidence stays.
Put what you have seen in the email. I reply within one working day, sooner if I can.
- 01
Contain
Stop the damage: isolate the site, rotate passwords and keys, keep evidence.
- 02
Hunt
Find web shells, reverse shells, rogue cron jobs, injected code, new users and crypto miners.
- 03
Trace the way in
Read the logs to find the entry point: an old plugin, a weak password, an unpatched service.
- 04
Clean & rebuild
Remove every hostile file, or rebuild from a known-good state when trust is gone.
- 05
Harden & watch
Patch the hole, lock things down, and set up alerts so you know first next time.
What you get
A findings list ranked by risk, with a fix for each.
Every audit ends with a report and a walk-through call. Each finding says what it is, why it matters, and three ways to fix it: do it yourself, ask your IT supplier, or hire me.
- Owner summary. One page, no jargon.
- Findings. Ranked critical to low.
- Fix plan. Costed, in priority order.
- Quick wins. Free fixes you can do today.
Example findingssample data
| Risk | Finding | Fix |
|---|---|---|
| Critical | Web server runs Debian 10, out of security support since 30 June 2024 | Rebuild on Debian 13 |
| Critical | Backups sit on the same server they protect | Off-site copy, test restore |
| High | PHP 7.4 in use, end of life since November 2022 | Move to PHP 8.3+ |
| High | Root can log in over SSH with a password | Keys only, no root login |
| Medium | No DMARC record: anyone can send mail as your domain | Add SPF, DKIM, DMARC |
| Quick win | MySQL uses a 128 MB buffer pool on a 16 GB server | One config line, faster site |
Services & prices
Published prices. Fixed before any work starts.
Most IT firms hide their prices. Here are mine. All prices exclude VAT. Charities, schools and community groups get 15% off audits.
1 to 9 staff
Health Check
£750
- Half-day on site plus remote checks
- 8 to 12 page report
- 30-minute walk-through call
10 to 49 staff
Business Audit
£1,950
- Full-scope audit of every layer
- Report, risk register and fix plan
- Walk-through with your team
50 to 249 staff
Organisation Audit
from £5,500
- Full scope plus staff interviews
- Board summary and fix plan
- Re-test of your top 5 fixes
Remote · UK & worldwide
Web Server Audit
£1,200
- nginx or Apache, PHP-FPM, MySQL tuning
- TLS, OS patch level, backups, headroom
- Report with ready-to-apply config fixes
Remote · UK & worldwide
Remote Cloud Review
£1,200
- Microsoft 365 or Google Workspace
- Domains, DNS and email security
- Cloud spend and waste
Any size
Cyber Essentials readiness
£900
- Gap check against the five controls
- A fix list in plain English
- Help with the question set
Hacked site or server clean-up
Billed at the day rate. Call or email and I will tell you honestly how long it should take.
£550 a day
Fixes & remediation
Fixes from your report, Ansible and Terraform work, migrations and rebuilds.
£550 a day · or £700 for 10 hours
Retainer
For past audit clients: a quarterly re-check, remote advice and priority booking.
£300 a month
Founding clients
The first two audits are half price.
Scaley Consulting is new. The first two clients get 50% off any audit, in return for a short written case study and one referral when the work is done. You still get the full report and the full walk-through.
Book a fix within 60 days of your audit and half the audit fee comes off the bill.
How it works
Four steps, no surprises.
Free call
20 minutes. You tell me what worries you. I tell you if I can help.
Fixed quote
A written scope and price. Nothing starts until you agree.
Audit
On site, remote or both. Read-only access, no disruption to your day.
Report & fix
Walk-through of the findings. Fix it yourself, or I fix it.
Ten years of kit I know inside out
Tools and systems: Debian, Ubuntu, RHEL and AlmaLinux, Windows Server, nginx, Apache, LiteSpeed, PHP-FPM, MySQL, MariaDB, PostgreSQL, Redis, Varnish, Proxmox VE, VMware vSphere, Ganeti, KVM, Ansible, Terraform, Cloudflare, BIND, Postfix, Exim, Dovecot, WordPress, Magento, cPanel, Plesk, iptables and nftables, WireGuard, ClamAV and Fail2ban.
About
Hello, I'm Simon.
I have spent ten years running servers for commercial web hosting companies: thousands of customer sites, the hardware under them, and the 3 am calls when something broke. Scaley Consulting is that experience, pointed at your business.
I am based in Manchester and happy on a train. For remote work, anywhere with an internet connection is fine.
- What I am like to work with
- Calm, curious and direct. I explain things without making anyone feel small. If something is fine, I say it is fine.
- Where the name comes from
- Dragon scales. Lots of small layers of armour, and the dragon is only safe when every one is checked. Also, I like dragons.
- The sister company
- Scaley Hosting runs managed web hosting. Scaley Consulting is kept separate so the audit advice never has a hosting sale behind it.
- How I keep my own house in order
- Every server I run is in code, patched on a schedule, backed up off site, and restore-tested. I ask you for nothing I do not do myself.
Questions
Things people ask first.
Will the audit disrupt my business?
No. I work with read-only access where I can, and I agree any test that touches live systems with you first. Most of the work happens out of hours or remotely.
We already have an IT supplier. Why would we need you?
Because nobody should mark their own homework. I give you an independent view, and many suppliers welcome a clear fix list. I can brief them directly.
Do you only work in Manchester?
On-site audits are UK only, based in Manchester. Web Server Audits and Remote Cloud Reviews work anywhere in the world.
What happens to our data and passwords?
I sign a confidentiality agreement before I start. Client data stays on a dedicated, encrypted audit laptop. I ask for the access I need, and you remove it when I am done.
Is this a penetration test?
No. A penetration test tries to break in. My audit checks how everything is set up and maintained, which finds the causes behind most breaches: old software, weak settings and missing backups. If you need a formal pen test, I will say so and point you to one.
What do you need from me to start?
An hour of someone's time to walk me through what you have, a list of the systems and suppliers you know about, and read-only access to the systems in scope. I send a short checklist before the first day, and I help you work out what is in scope on the free call.
Our insurer or a client has sent a security questionnaire. Can you help?
Yes. Cyber insurance forms and supplier questionnaires ask about the same things an audit checks: updates, backups, access and multi-factor sign-in. The report gives you honest answers, and I can help fill in the form.
What if everything turns out to be fine?
Then I tell you so, in writing, and you have an independent report that says it. That is worth having for insurers, clients and your own peace of mind. You will not get a list of invented problems to justify the fee.
Do you have to fix everything you find?
No. The report is yours. Every finding has a do-it-yourself fix, a fix for your supplier, and a price if you want me to do it. There is no pressure to hire me for the fixes.
Let's talk
Book a free 20-minute call.
Tell me a little about your setup and what keeps you up at night. I reply within one working day with a few times for a call.
contact@scaley.consulting- Roughly how many staff you have
- What you run: servers, a website, Microsoft 365, Google Workspace
- What prompted you to get in touch
No call centre, no sales team. It is just me, and I read every email. Simon