Head product
Infrastructure audit: what is exposed, what is slow, and what it costs you
A week of work, a written report, a fixed price to fix it. You can stop there — the report is yours either way.
01
What we check
- TLS: versions, cipher suites, chain, expiry, and how certificates get renewed
- Whether the origin answers directly, bypassing the CDN and the balancer — the most common finding
- WAF: whether there is one, what mode it runs in, and what it actually blocks on your traffic
- Rate limits and behaviour under a burst, including header-based bypasses
- Security response headers, and what they in fact permit
- DNS: delegation, DNSSEC, and records that survived a migration and serve nobody
- Mail: SPF, DKIM, DMARC, sender reputation, and whether you land in spam
- What is exposed besides the application: panels, metrics endpoints, forgotten subdomains
- Servers and cloud: where the load lives, where the single points of failure are, what it costs and where it could cost less
- Storage and backups: Ceph, S3 or local disks, whether a copy exists off-site, and whether it has ever been restored
- The PHP application: TTFB and p95 under load, PHP-FPM, OPcache, slow queries, outdated modules and plugins
02
What you get
- Findings ordered by what they could cost you, not by how easy they are to fix
- Reproducible steps for each one, so your own team can verify it
- What is a config change, what needs rebuilding, and what is fine as it is
- A fixed price and timeline for the fix, if you choose to continue
Timeline and price
About a week from the moment we have access. $500–1500 depending on size: how many servers, domains and applications. The number is agreed before the work starts and does not move during it.
Write to hello@rxt.sh with the domains, what the service does, where the servers are, and what worries you — speed, the bill, security. You get a price and a date the same day.