UK services

Hardware lab, websites & cloud help.

Wipes and repairs in our lab, protection for your site, and help cutting cloud bills. Browse ready stock or ask for a quote anytime.

2 Jump to a section — or scroll to read everything

Everything for your topic is on this page. Keep scrolling for prices, steps, and contact links — no hidden tabs.

UK lab

UK firmware & sanitization lab

Secure data wiping, hardware recovery, and checks before resale — with a written report you can share with buyers or insurers. Tell us make, model, and what you need; we quote before any work starts. Ready kit on inventory.

Request an audit What the lab includes

Websites

Website protection & monitoring

We harden your public site, tighten hosting, and can alert you when something looks wrong — without enterprise jargon on the call.

Edge

Website protection

Cloudflare WAF, TLS, bot controls, and HTTP security headers scoped per hostname.

Posture

Public surface audit

Baseline review of your internet-facing footprint before attackers map it for you.

SOC

SIEM monitoring

Agents and log forwarders with tuned detection rules—aligned to your stack and risk profile.

Response

IR triage

UK first response when alerts fire—practical containment without six-figure retainers.

Sovereign Shield delivery stack — the same class of tools we deploy for clients and use on our own platform: Cloudflare (DNS, TLS, WAF, bot management) in front of your origin; Wazuh (or your SIEM) for log ingest and tuned rules; hardened application hosting (HTTPS-only cookies, CSP, rate-limited auth); Stripe for secure checkout where e-commerce applies. Your hostname gets orange-cloud proxy, strict SSL mode, and documented WAF rules—not just a certificate pasted on the server.
Darkhorse HQ Web Hardening

Plans we deploy for clients—and on this site

Structured hardening so your public site is not just “HTTPS on”—edge protection, headers, rate limits, and optional monitoring. Pick a tier; upgrade to full Sovereign Shield when you need SIEM and IR.

Tier 1 · Essentials

From ~£350 (simple sites). Cloudflare proxy, Always HTTPS, WAF baseline, bot/scrape rules, security headers (HSTS, CSP, frame control), edge rate limits on login/API paths, external posture snapshot + handover PDF.

Tier 2 · Sovereign Shield

£650–£950 setup. Everything in Essentials plus origin/app review (cookies, sessions), OWASP-style blocks, and signed SOW outline. Optional: Wazuh/SIEM ingest + Slack alerts (quoted add-on).

Tier 3 · App + commerce

From ~£1,100 (on top of Essentials or Sovereign Shield, quoted). Auth portals, shops, and APIs: admin MFA, app + edge rate limits, and the mature controls below—each item signed off in the SOW before we touch production.

Tier 3 · Mature application controls (what we deploy for serious apps)
  • CSRF tokens on state-changing forms (contact, login, checkout, admin)—synchronizer tokens or double-submit, validated server-side.
  • Stricter CSP — reduce or remove unsafe-inline; nonces/hashes for scripts; document any required exceptions.
  • Stripe webhook hardening — signed payloads (whsec_), idempotent handlers, replay-safe event processing, separate test/live endpoints.
  • Cloudflare Turnstile on public forms and auth paths to cut bot abuse without captcha friction.
  • DNSSEC — enable at registrar for apex and critical subdomains; verify chain and document rollover with client DNS owner.
  • Backup & restore test — documented RPO/RTO, one supervised restore drill (DB + files or PaaS snapshot), and handover checklist.
On darkhorsehq.co.uk we practice what we sell: HTTPS + canonical domain, Host allowlist, optional Cloudflare-only origin lock, HSTS, Helmet CSP, CSRF/Turnstile on forms, attack-pattern blocking, auth lockout + MFA for admin, Stripe webhook verification, and a public security.txt for responsible disclosure.

SOW outline (PDF) Request web hardening scope

When something goes wrong

Incident response you can actually afford

If an alert fires or you suspect a breach, you should not need a six-figure retainer before anyone picks up. Darkhorse HQ gives your team a UK-based first responder—clear-headed triage, containment guidance, and honest next steps.

  1. You reach us — alert, suspicious activity, or “we think we’ve been hit.” We respond with a structured triage call, not a sales pitch.
  2. We assess fast — review of your SIEM/telemetry (or logs you can share), separate false positives from real risk, and recommend immediate isolation or hardening steps.
  3. We escalate fairly — if you need courtroom-grade forensics or insurer-approved remediation, we broker pre-vetted specialists at transparent pricing—no enterprise markup.
From £250

Emergency triage — indicative first two hours of analysis and containment advice. Final scope confirmed in your SOW.

Brokered

Specialist handoff — when the job needs deeper forensics, we introduce trusted partners and help you compare options before you commit.

Request IR triage
Prices & estimate

Website protection — ballpark quote

Adjust the options to match your site. Most small businesses pay setup only first; ongoing advisory is optional. Final price is confirmed in a signed scope before work starts.

Each name you put behind Cloudflare (www, shop, api) needs its own security rules and certificates — extra names add setup time, not “extra websites you didn’t ask for.”

Indicative total

—
Email this estimate to us

Setup typically includes

  • Cloudflare in front of your site (HTTPS, firewall, bot rules)
  • Security headers and a review of how the site is hosted
  • Written handover you can keep for insurance or Cyber Essentials

See Tier 1–3 packages · Ask for a simpler Tier 1 quote

Cloud

Cloud governance & cost control

Read-only billing access, waste scans across AWS/Azure/GCP, and SaaS seat cleanup—delivered with the same runbooks we use internally.

Cloud services detail Book intro call

Part 3

Cloud cost reduction

Measurable cash back—clients see savings on the first invoice. Complements ongoing governance and advisory retainers.

  1. Intake — Cloud and SaaS (M365, hosting, Zoom, etc.): read-only billing access or invoice exports.
  2. Cloud waste scan (read-only) — Cost Explorer / Advisor plus automated checks (unattached disks, idle compute, stale snapshots, unassociated IPs). We run the same playbook on AWS, Azure, or GCP.
  3. Subscription cleanup — License overlap and zombie seats (unassigned M365, duplicate tools). Mapped to £/month waste like infra.
  4. One-page waste report — e.g. “£1,200/mo spend; ~£450/mo avoidable (VM + SaaS).” You sign off before anything is deleted.
  5. Safe optimization — Backup-first cleanup and right-sizing; fixed fee or savings-share below.

Internal fee vs value-share model: sign in → Portal → Sales calculators.

£400

Option A — fixed project — audit + remediation pass and basic auto-scaling hygiene.

20–30%

Option B — value share — lower upfront; share of verified savings over 3–6 months.

Request cloud waste audit