If you are here about a hacked-site cleanup, read section 10 first: it states the cleanup sequence and the full-refund rule that govern your job, and it overrides the general terms wherever they differ. The prices in section 2 belong to the separate Website Protection service.
1. What the service is
KOLLAZ is a website security check and remediation service covering three review areas: PHP patch status for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), WordPress version status for CVE-2026-87902, and email authentication (DMARC, SPF, and DKIM) enforcement. The free check is a review of available evidence. It is not a full security audit, penetration test or certification, and no review or fix can guarantee that a site will never be attacked. This service is not an MSP or IT support service: we do not manage your computers, network, hosting account, or other software.
2. Offers and prices
Three offers, always shown together, all one-time prices in Canadian dollars:
- Fix It: CA$197. The single worst proven problem fixed: an exposed PHP patch, a WordPress core fix, or DMARC enforcement for one domain. Includes a full backup before any change, the fix, agreed checks, and a written verification record.
- Secure It: CA$397. Every proven finding fixed in one job, plus a hardening pass (exposed files closed, login protection checked, update settings set), a full proof pack at handover, and 30 days of fix-it cover on the work.
- Secure It + Keep It Safe: CA$797. Everything in Secure It, plus 12 months of watch included and priority start on emergency work during the year. The watch is version and patch monitoring, DMARC report reviews, a plain-language monthly report, and alerts when a new critical fix leaves your site behind. After the included year, the watch renews at CA$49 per month if you keep it. That is the single renewal rate for everyone; there is no care menu.
- The watch on its own: CA$49 per month. The same watch is also available standalone to any site owner, with no prior job required. The watch never includes fix work; if a fix is ever needed, it is quoted separately in writing before any work.
Scope honesty: patch-class findings are covered at the prices above. Two kinds of job are priced exactly in the written scope step instead, before any work: platform moves (a PHP or WordPress too old to patch in place, for example PHP 8.1 and older with no patched release) and hacked-site rebuilds where the database is compromised. Hacked-site recovery enters at Secure It at minimum, because cleanup without closing the entry point reinfects.
3. Sequence of a job
- You request the free check and receive a written finding.
- Where work is needed, you receive a written scope and a fixed price.
- You accept the scope in writing.
- You pay through a secure hosted Stripe payment page. Card details never pass through this site or email.
- You provide temporary access for the agreed work only.
- We take and confirm a full backup before any change, apply the fix, run the agreed tests, and document the verification record.
- You receive the verification record, and the temporary access is revoked.
- The watch, if wanted, is agreed separately; it can start after a job is complete, or on its own as a standalone monitoring service.
4. Eligibility
- Fix It PHP covers sites on supported PHP branches (8.2 and newer) that can take the branch security update on their existing hosting. Sites on older branches are platform moves under section 2.
- Fix It WordPress covers sites that can take the core update to the fixed release for their branch. Sites on WordPress older than 4.7 are platform moves under section 2.
- Fix It DMARC covers one email domain whose sending services can be mapped and authenticated.
- Sites on fully managed platforms (for example Shopify, Wix, Squarespace, WordPress.com) are not eligible for website fixes, because the provider controls the runtime. The provider's written confirmation is the right route there. Their own email domains can still be checked and fixed.
- Eligibility is confirmed by the free check before any payment. An ineligible site is told why, in writing, with no charge.
5. Exclusions
- Suspected compromise cleanup beyond the Secure It entry scope: assessed and scoped separately before any work; a patch alone is not a cleanup.
- Pre-existing breakage, unrelated updates, redesign or content work.
- Compatibility rework beyond the items itemized in your written platform-move scope.
- Hosting, domain or third-party licence fees.
- Anything about your computers, network, or software other than the website and email domain in scope.
6. Payment, guarantee, and no refunds
Payment is made in advance, after written scope acceptance, through the hosted Stripe payment page. Payment is final and there are no refunds.
The guarantee is the documented work itself, bounded by your written scope. It consists of three commitments: (1) the scope and fixed price are confirmed in writing before any work; (2) a full backup is taken and confirmed before any change; (3) the work itemized in your scope is performed, the agreed checks are run, and you receive the documented verification record at handover. If an upgrade cannot be completed safely, the confirmed backup is restored: that returns your site to service and counts as a restoration, not a completed fix, and the next step is agreed with you in writing. There is no promise beyond the written scope and these commitments. The 30 days of fix-it cover in Secure It covers defects in the work we performed; it does not cover new flaws, new compromises, or changes made by others.
7. Access and backups
Access is requested only after scope acceptance and payment, is limited to what the work needs, and is revoked at handover. You are responsible for your own ongoing backups outside the job backup taken under section 3.
8. Liability
Conclusions are stated exactly as strongly as the evidence supports. Nothing in these terms promises immunity from attack. Liability for a job is limited to the amount paid for that job.
9. Changes to these terms
These terms are dated and versioned on this page. The version in force when you accept a written scope is the version that governs that job; later edits never apply retroactively to an accepted scope.
10. Founders Fifty cleanup: a different sequence
The Founders Fifty is a cleanup programme for hacked WordPress sites, limited to the first 50 businesses recorded in our register. For a Founders Fifty cleanup, this section governs where it differs from sections 2, 3, 5 and 6.
- Price: CA$299 flat for one WordPress site. A big or complex site is quoted flat in writing before any work; the quote is the price, with no hourly meter and no extras added later.
- The sequence: you ask for the free evidence check and receive the evidence report. If you accept the cleanup, you pay the flat price in full, through the hosted Stripe payment page. We then take a full backup, clean the site, close the way in, and harden it. You receive the proof report: the written record of the work, what was found, what was removed, and what was closed.
- Start: we start once your payment is confirmed and you have given us the access we need.
- If we cannot clean it, your payment is refunded in full, automatically. You keep the evidence report and the backup.
- 90 days of cover: if your site is hacked again within 90 days of your cleanup, we clean it again at no charge.
- Protection at the special rate: if you take the protection plan (monitoring, updates, backups, and free re-cleans) with your cleanup, you pay CA$399 a year, and that rate stays yours for life. The standard bundle price is CA$999 a year.
- After the 50: when the register reaches 50 claimed, the standard prices on the Founders Fifty page apply: cleanup CA$399 flat, cleanup plus 12 months of protection CA$999 a year, emergency start CA$599 flat.
For the offers in section 2, section 6 stands as written: payment in advance, and payment is final. A Founders Fifty cleanup also pays in advance, with the one exception this section describes: a cleanup we cannot complete is refunded in full, automatically, and section 6's no-refund rule does not apply to that case.