How we work out the numbers

The shape of a calculation

Each finding declares how it costs money, not how much. Seven mechanisms are possible: visitors lost, trust eroded, traffic that never arrives, legal exposure, fraud exposure, incident exposure, and downtime. The engine turns the mechanism plus your business profile into a range.

Where a finding describes a one-off event, such as a fine or a fraud, we multiply the typical cost by the chance of it happening in a year and divide by twelve. That is why a rare, expensive risk shows a small monthly number. It is not a prediction that it happens every month.

Starting figures by kind of business

These are the defaults before you correct them. They are deliberately modest. A scanner that assumes every business gets fifty thousand visits a month produces impressive nonsense.

How people behave

Where a published range exists, we take the conservative end. We would rather be dull than wrong.

abandon on security warning28.0%

GlobalSign consumer trust research, 2024; conservative end of the reported rangeReported effects run higher. We use the low end deliberately.

form abandon on insecure field42.0%

Baymard Institute checkout usability research, security signalling

mobile traffic share63.0%

StatCounter global mobile share of page views, rolling 12 month average

mobile unusable penalty55.0%

Google mobile usability guidance; effect on task completion

loss per second delay7.0%

Deloitte Milliseconds Make Millions, 2020; 0.1s improvement moved conversion 8%

ctr loss no description6.0%

Aggregate SERP click-through studies; conservative midpoint

local pack loss no schema12.0%

Local search visibility studies on rich result eligibility

trust signal loss9.0%

Edelman and BrightLocal consumer trust surveys on business legitimacy signals

Costs of things going wrong

accessibility claim

Typical cost: £25,000 (UsableNet year-end digital accessibility lawsuit reports; typical settlement plus remediation)

Chance in a year: 0.8% (Filings against small businesses as a share of US small business websites)

data protection action

Typical cost: £9,000 (ICO small-business enforcement outcomes plus typical response cost)

Chance in a year: 1.2% (Complaint-driven enforcement rate; cookie consent is the most reported category)

email impersonation

Typical cost: £19,000 (FBI IC3 annual report, BEC median loss for small business filers)

Chance in a year: 2.1% (IC3 BEC complaint volume against registered small business count)

site compromise

Typical cost: £4,200 (Hiscox and Verizon DBIR small-business incident cost, cleanup plus downtime)

Chance in a year: 4.0% (Sucuri and Wordfence infection rates across scanned small-business sites)

card compliance failure

Typical cost: £5,500 (Acquirer non-compliance fees plus forensic review, small merchant tier)

Chance in a year: 3.0% (Merchant assessment failure rates in the SAQ-A population)

What we check

169 checks across 12 areas. A free scan runs 41 of them and shows every result in full, priced, with the arithmetic. The rest look at things your visitors never see, or need proof you own the domain before we may ask your server for them. Whatever we run, you see all of it: nobody should have to pay to find out what we already know about their own website.