Show your broker the evidence

Two halves, and only one of them costs anything

Hardening
Free forever

Nine security controls you can switch on and off individually: two-factor sign-in, login rate limiting that counts by address and by username, a custom sign-in URL, XML-RPC off, the file editor disabled, version fingerprints removed, and more. Every change is logged with who made it and when. No licence needed, ever.

Evidence pack
$149 CAD / year

A dated PDF your broker can read, plus a matching JSON file with the same facts in machine-readable form and a checksum tying the two together. Covers your controls, your accounts, your backups and your documented exceptions. Generate a fresh one whenever you need — before a renewal, after a change, as often as you like while the licence is current.

What the pack actually says

Your controls,
as they stand

Each of the nine controls, passing or not. WordPress and PHP versions and whether updates are outstanding. HTTPS and HSTS. Whether the file editor and XML-RPC are open.

Your people
and your backups

Administrator accounts, their roles and last sign-in, dormant accounts, and how many application passwords exist per user — never their values. Whether multi-factor is in place. Your declared backup restore test.

What you decided
to live with

Exceptions you have recorded, with your reason and the date. A documented, dated decision reads far better to an underwriter than a gap they discover themselves.

A plain-English
summary

A “what to send your broker” box, because the usual mistake is sending a technical document to someone who needed one paragraph and a date. Timestamped, with a review date 90 days out.

Please read this part

We would rather lose a sale than have you buy this expecting something it is not.

Get the plugin — free, no licence needed

Download it and install it before you buy anything. All nine hardening controls work immediately and permanently without a licence, and the Settings screen prints the exact site address you will need at checkout.

Download version 1.1.0

In WordPress: Plugins → Add New → Upload Plugin, choose the file, install, activate. Requires WordPress 6.0+ and PHP 7.4+. No Composer, no build step, no dependencies.

It never phones home

Your licence is a signed key that your own server checks by itself. There is no activation call, no licence check, no usage reporting and no remote access. We do not learn that you installed it, when you generate a pack, or whether you are still using it. It keeps working exactly as it does today if Kwistech disappears tomorrow.

The only network requests the plugin makes are to your own website address: one to check for a security header, and one to confirm a new sign-in address works before saving it. Nothing else leaves your server.

There is no payment code in the plugin either. You buy here, on this site. Your WordPress installation has no card fields and no payment credentials of any kind.

$149 CAD

One website, for one year. That is the whole price — no tax is added at checkout and there is nothing else to pay. While the licence is current you can generate the evidence pack as often as you need: no per-report charge and no usage limit.

You will be asked for your website address at checkout. A licence works only on the site it was issued for, so enter it exactly as it appears in your WordPress settings. Your key is emailed to you, normally within one business day.

If your site moves to a new domain, email us and we will reissue the licence for the new address at no charge.

Refunds: if you were charged and your key never arrived or never worked on the site you bought it for, you get a full refund. Once a licence has been used to generate a pack, the product has been delivered.