Frequently asked questions

No. Buy one website or fifty, at the same price each. There used to be a four-website minimum on our top plan and we removed it, because it meant the price we advertised was not a price anyone could actually pay.

A free account is scanned monthly. Any website you pay for can be set to daily, weekly or monthly, and you choose that per website, so a critical site can run daily while a brochure site runs monthly. You can also run an on-demand scan whenever you want one.

No separate plan. BSO Cloud Essentials, our small-business profile of ASD's Essentials for cloud, is assessed every month as part of our Microsoft 365 Partner plan, which already includes scanning for up to 5 websites and your Microsoft 365 diagnostic. What those scans find is recorded as evidence against the controls it covers. A free account still covers one website, scanned monthly.

Yes. Go to the subscription page and adjust the number of websites up or down at any time; billing is prorated automatically. Team members work the same way. Service plans are month to month: tell us and we change them from the next month.

No. Biz Secure Online's scanners test the public perimeter of your digital service. We do not install software of any kind on your infrastructure.

We test your public perimeter, which is what the outside world can see about your website or online service. It's the first line of defence, and often the most vulnerable. We scan what the internet sees such as exposed services, misconfigurations, outdated software, open ports, insecure headers, SSL problems, your site's loading speed and how your SEO is configured. This is what anyone from script-kiddies to the North Koreans can see. If you have a business website on the internet, then this is the bare minimum of stuff you should be aware of.

Our scan engine has been configured to give the best essential site information in the shortest possible time. Generally that's about 15 minutes as a rule of thumb. For sites that function as digital business cards - static text without any interactive features such as calendar booking, document upload or handling newsletter interest submissions - this can be somewhat shorter. Similarly, for large sites, it will take around 20% more time.

On your website hosting, no. Fixing those issues needs someone with administrator access to your server environment, and we do not have it. Your report says what to change, and gives your developer or host a ready-made prompt to work from.

In your Microsoft 365, yes. Our Monitor and Partner plans include 2 and 4 hands-on hours a month to fix what we find, and we check again to confirm it stayed fixed.

Every scan starts at a perfect score of 100. Our engine then deducts points based on what it finds: vulnerability severity, missing security headers, high-risk open ports, and WordPress-specific issues.

The final score is clamped between 1 and 100. A score of 85–100 is strong, 60–84 is moderate, and below 60 needs urgent attention.

SEO and performance scores are reported separately and do not affect the security score.

For a detailed explanation, see our guide: How We Calculate Your Security Score.

We have a growing library of plain-language guides that explain every component of your scan report, from SSL/TLS and security headers to performance metrics and open ports. Visit our Guides section to browse them all.

The AI prompts are the last step in the scanning stages. After all the test data is obtained and run through a santisation process to remove duplicates and false positives, it is pushed to Anthropic's Haiku model where the prompts are created. The prompts are then put into the final report and stylised with our presentation theme. Each prompt is custom generated from the data from the scan engine, providing highly specific advice on the impact of the discovered issues and how to fix them.

It is eight Microsoft 365 settings that close the most common ways a small business is broken into. Microsoft Secure Score checks 60 to 70 settings in a typical small-business tenant and has no finish line. The baseline picks the eight that matter first, so you know when you are in good shape.

It is a starting point, not a certification.

No, and we say so in the portal. Reaching the baseline does not mean you meet CISA SCuBA, ASD’s Blueprint, the Essential Eight, Cyber Essentials or any other standard in full. Each of those asks for much more.

Some sources also ask for more than Microsoft measures. For example, they ask for phishing-resistant sign-in for administrators, and Microsoft reports multifactor sign-in without its strength. The baseline covers eight settings in Microsoft 365; it does not assess devices, backups, people or processes.

The CIS Microsoft 365 Foundations Benchmark is published for non-commercial use, and claiming compliance with it requires a paid CIS membership. We cite freely published government baselines instead.