Gus for agencies and web studios
You look after other people's websites. Gus checks them every day, tells you in plain English when something changes, and hands you a report with your name on the front to send the client.
That's the Practice plan — £49 a month, or £490 a year. The same scanner as the free check-up, sized for a client list and with the deliverables a retainer is judged on.
What the plan covers
- Up to twenty-five client sites, checked daily
- Gus looks at each one every day and emails you when something changes — a certificate heading for expiry, a header that disappeared in a deploy, a plugin that started advertising a version with a published advisory. When nothing has changed, you hear nothing, and a monthly summary says how many times Gus looked.
- twenty in-depth assessments a month
- The graded, evidenced report: an active scan of a site you have proved, written up with what was found, what it means and what to do. This is the document that justifies a care plan at review time, rather than a line item nobody can see.
- Reports with your name and logo on them
- Set a practice name and upload a logo, and the three PDFs you download carry them on the cover and in the footer. A small “Powered by Gus” line stays: the methodology section names the scanner, and hiding where a security document came from would be its own kind of dishonesty.
- A badge for the sites you watch
- A “Gus checks this site” badge you can put in a client's footer, linking to a page that says plainly when it was last checked. Visible proof the care plan is doing something, on the client's own site.
- Room to keep thirty
- The plan watches twenty-five and the account keeps thirty, so a full client book still leaves room for your own site and for the ones you have finished with but want the history on. Attaching is free; watching is what the plan buys.
The one thing to check before you sign up
You need to be able to prove each client site is yours to test. A DNS TXT record, or a code sent to one of the site's standard mailboxes — per site, once. If you hold your clients' DNS, that is a five-minute job and normal agency practice. If you don't, the in-depth assessment won't run, and it is better to know that now than after a payment.
This is the Computer Misuse Act rather than a plan feature. Gus's free check-up is passive — it only looks at what any visitor's browser or a public DNS lookup would see — and anything more active is gated on proof, on every tier, at every price. Daily monitoring and the badge work on an attached site whether or not it is proved; the assessment is the part that needs it.
What you can put in front of a client
Every report is written for the person paying you, not for a security team. Three questions per finding — what Gus found, what it means for the business, what to do about it — with the raw headers and records kept in the technical download for whoever does the work.
The in-depth assessment also carries a Cyber Essentials readiness section: which of the scheme's themes this assessment actually saw evidence for, and — said just as plainly — how much of Cyber Essentials is about devices, accounts and process that no website check can see. It is not a certification, it never predicts a pass, and it points at the official self-assessment for the rest. Useful when a client's insurer or a tender has started asking.
What Gus will not do is manufacture urgency for you. A site with nothing wrong gets a report that says so, and a quiet month gets a summary saying how many times Gus looked and found nothing moving. Anything else would make the reports worth less every time you sent one.
More sites than that?
Looking after more than twenty-five sites? There isn't a bigger plan on the shelf yet, and rather than invent a price we'd rather have the conversation. Tell us how many you look after and a person will reply.
Run one on a site of your own before you decide anything. The free check-up needs no account and no card, and it is the same scan the plan runs every day.