“Looks good.
Ship it.”
- A homepage that passes the screenshot test.
- Your logo, some copy, a contact button.
- “SEO included” with no research or plan.
- No clear answer about who looks after it.
WHAT YOU NEED TO KNOWBEFORE THE INVOICE. BEFORE THE REGRET.
Beauty is only
the beginning.
AI can build what you ask for.
Experience knows what to ask.
A beautiful website should make you stop and look. The work underneath should give you a reason to trust it.
You shouldn’t need a computer science degree to buy a website. It’s our job to explain the things you might never think to ask. Even if you don’t choose us, take these questions with you.
01 / THE REALITY CHECKTHE PRICE IS ONLY THE FIRST QUESTION.
A website in a sentence.
A business on the line.
AI makes the first draft fast. It doesn’t remove the need to know what belongs in the brief, what could go wrong, or how to test the result.
“Looks good.
Beautiful.
Thought through.
- A clear purpose, useful content and a deliberate design.
- Mobile, keyboard and screen-reader checks.
- Smaller attack surfaces and a tested release.
- Named responsibility for care, recovery and growth.
Some clients invest more than $500 each month in getting found alone. What does a $500 total build actually leave room for?
What a small budget can—and cannot—cover
Our clients can invest more than $500 a month in SEO and AI-search visibility alone. That is ongoing work to help the right people discover the business. So what can a $500 total build budget realistically include?
Strategy, service content, original design, accessibility, responsive layouts, performance, security and testing each need attention. Then there is the care after launch. A low price is only meaningful when you know which of those jobs it covers—and which it leaves to you.
When you see AI produce a website from a sentence, a $500 build can sound entirely reasonable. That is understandable: the visible result arrives quickly. The unseen requirements are harder to judge.
That is where the person directing the AI matters. If a requirement never enters the brief, a convincing result can still be incomplete. You are paying for someone to recognise the gaps, challenge the output and verify the result—not simply press Generate.
AI can generate a good-looking page in minutes. That does not mean the whole job takes minutes. Someone still needs to understand your business, choose the architecture, check the code, test accessibility, secure the release and plan what happens after launch.
A $500 site can suit a genuinely small, well-defined brief. But if the promise includes custom strategy, original design, security engineering, comprehensive testing and ongoing marketing, ask where the time for all that work comes from. Price alone cannot tell you whether a site is safe. Neither can a polished screenshot.
Does it include your content, mobile testing, keyboard access, useful service pages, ownership of the files, hosting, backups and support? Or is it a template, your logo and a handshake?
A neglected or badly configured site can cost far more than its build price: recovery work, lost enquiries, damaged trust and, depending on the incident, legal or regulatory consequences. A serious incident can threaten a business. That is a reason to ask better questions—not proof that every inexpensive website will be hacked.
Ask what happens after launch. Who fixes a broken enquiry form? Who checks an unexpected change? Who does the research and content work? A low build price doesn’t make those jobs disappear.
02 / THE INTERNET MOVED ONYOUR BRIEF NEEDS TO MOVE WITH IT.
Small business.
Same internet.
Your website has to open its doors to the world. That includes people you’d never invite in.
The internet grew around connecting networks and sharing information. It wasn’t designed around today’s public websites and AI-assisted attackers. Security has had to evolve alongside it, layer by layer.
A visitor doesn’t arrive with a reliable label saying “customer” or “attacker”. The challenge is to let people read, enquire and buy without giving every stranger access to the machinery underneath. Being open to visitors must never mean trusting every request.
Automation means an attacker doesn’t need to know your business exists before testing it for weaknesses. Small, new and quiet are not security controls. AI adds another reason to keep reassessing how we build and defend the systems we expose.
We can’t wait for a future internet to solve that tension. We build for the one your business uses today: fewer exposed components, restricted permissions, careful testing and ongoing monitoring and maintenance. The approach must keep evolving as the threats do.
Background: Internet Society’s history of the internet.
See how that changes the build
Before launch.
Secure staging and accounts before the site becomes publicly reachable.
Beyond your files.
A compromised site can redirect or deceive visitors who already trust your name.
Throughout its life.
Someone needs to own the checks, the changes and the response.
AI, automation and the threat: the evidence
An automated probe does not need to know your name or care how small your business is.
Automated scanning and stolen passwords existed long before generative AI. AI can now help attackers research targets, write code and produce convincing scams more efficiently. A lone operator can use automation to attempt attacks at a scale that manual work would not allow.
Public tutorials, shared attack tools and AI assistance lower the learning barrier. YouTube and other platforms host material marketed as AI jailbreaking or hacking instruction; a demonstration is not proof of a reliable attack, and legitimate security education exists too. The practical concern is that someone can attempt attacks without first becoming an expert.
The UK’s NCSC assesses that AI will make parts of cyber intrusion more effective and efficient. Read the NCSC assessment. That is serious enough without inventing a count of millions of “jailbroken AI crawlers”. AI does not need to be jailbroken for every misuse, and a crawler still needs a weakness or a person to deceive.
Plugins, admin logins, forms, third-party scripts and AI integrations each need a reason to be there—and someone accountable for maintaining them. Adding an AI assistant can also introduce new risks around instructions, data access and actions it is allowed to take.
We scope those permissions. A chat widget should not quietly become a master key.
Search engines need to reach useful public content. Harmful automation needs different controls. Blocking every bot can damage the visibility you are paying to improve.
A robots.txt file is a request to cooperative crawlers, not a lock on your website. Access controls and monitoring do the security work.
How a public build can be found before launch
A public test site can be found before its owner announces it. Publicly trusted TLS certificates commonly expose hostnames through Certificate Transparency logs. Researchers have documented bots watching those logs and visiting newly disclosed hosts.
That means a fresh HTTPS certificate can make a new hostname easier to discover. It does not itself infect the site, and not every scanner is malicious. But an unfinished, publicly reachable installation with an exploitable weakness is not protected by being new or obscure.
Read the USENIX research on Certificate Transparency bots.
Keep HTTPS. Protect the build before exposing it. Use private or access-controlled staging, secure accounts and configuration from the start, then test before opening public access. A hidden link, an “under construction” page or a noindex tag is not access control.
Do not leave security until the last afternoon of the project. By then, a public build may already have been discovered and attacked.
What a compromise can mean for visitors
A website compromise can reach beyond your own files.
An attacker who gains control may inject a fake verification screen, redirect visitors or deliver malicious downloads. Your familiar domain becomes the convincing part of the deception.
Microsoft has documented ClickFix campaigns in which compromised websites lure people into running malicious commands, sometimes disguised as CAPTCHA verification. Resulting malware can steal information or provide remote access. This does not mean every visitor is automatically infected just by opening a page; the infection route matters.
Read Microsoft’s ClickFix research.
The consequences can extend well beyond a stolen website password. A visitor’s device may contain business credentials, private documents or keys and recovery phrases controlling valuable cryptocurrency assets. Microsoft has documented malware that targets saved browser credentials, wallet information and clipboard contents. Read Microsoft’s StilachiRAT analysis.
You do not know the value of what a visitor has on their machine. That is another reason to take the trust attached to your domain seriously.
A site can still appear normal while malicious content is shown selectively. “It loads on my laptop” is not a security assessment. That is why the conversation must include prevention, detection, response and recovery.
03 / DIGITAL OVERWATCHTHE VIEW FROM HIGH GROUND.
The website sleeps.
The responsibility doesn’t.
Overwatch is the lookout above the team. For a website, that means watching for trouble and having a response ready.
Know what belongs.
Notice what changes.
Be ready to act.
The polished homepage is only what visitors see. Behind it, the care plan needs to cover monitoring, maintenance, response records and recoverable off-site backups.
That work takes time, judgement and ongoing funding. It cannot make a site invincible. It can make the care deliberate, documented and accountable.
Explore Website RescuesWhat ongoing care should account for
Think Indiana Jones: the floor looks ordinary, but something underneath notices when the weight changes.
The useful idea is layered safeguards: establish what belongs, watch for signs that something is wrong, and have a response ready. A website should not depend on its owner noticing that the homepage looks different. Digital Overwatch is the ongoing watch behind the presentation.
Security is not something we install and forget. It is work we keep doing—and work a one-off build price needs to distinguish from ongoing care.
Monitor for signs that something needs investigation. A website looking normal is not enough reason to stop checking.
Review relevant vulnerability intelligence, prioritise necessary patches and strengthen safeguards as threats and your website change.
Protect visitors, investigate, repair and verify before returning the affected service to normal. Relevant security checks should be repeated after remediation. Someone needs to own each step.
Keep an auditable record of authorised changes, checks and response actions. Planned updates need verification too, so approved improvements do not get confused with unexpected interference.
Your care agreement defines the coverage and response commitments for your site. Monitoring reduces uncertainty; it cannot guarantee prevention or detection of every attack. Specific operational methods remain private.
Who creates them? How recent are they? Do they cover what you actually need to restore? Has anyone tested that restoration? If the only copy is accessible through the same compromised hosting account, it may be at risk too.
Ask for independently protected, off-site recovery copies and a tested recovery process. “Backup included” needs a real answer behind it.
Response planning should account for the visibility you have invested in: appropriate temporary handling, careful restoration and checks on important pages and search access. A blanket redirect is not automatically the right answer.
No provider can promise an incident will leave rankings untouched. The aim is to limit harm and disruption, then restore a verified site—not rush an uncertain copy back online.
Responsibility, records and Australian notification rules
“We didn’t know” does not automatically remove your responsibilities. For entities covered by Australian Privacy Principle 11, reasonable steps must be taken to protect the personal information they hold. Whether a particular incident involves a breach of duty or liability depends on the facts and applicable law. Read the OAIC’s APP 11 guidance.
Your response may need more than a quick clean-up. Depending on the incident and your obligations, you may need to preserve evidence, assess personal-information exposure, obtain legal advice and notify affected people or a regulator.
In Australia, the Notifiable Data Breaches scheme applies to entities covered by the Privacy Act. Notification is required for an eligible breach: unauthorised access, disclosure or relevant loss of personal information, likely serious harm, and remedial action that has not prevented that likely harm. It is not a blanket rule to notify every person who ever visited a hacked website.
Read the OAIC’s notification criteria. Other reporting duties can also apply to particular businesses or incidents. Get advice about your circumstances rather than relying on an agency’s sales page.
Recorded releases, maintenance history, monitoring results and response records help show what was done and when. They do not automatically prove the absence of negligence, remove liability or guarantee an insurer will pay. A certificate is not legal immunity.
Ask for evidence of care throughout the site’s life—not a reassuring badge on launch day.
04 / DELIBERATE UNDERNEATHEVERY MOVING PART NEEDS A REASON.
Less exposed.
More considered.
We build with as few exposed entry points as the job allows. Necessary services are separated and carefully scoped, so convenience does not quietly become unnecessary risk.
PUBLIC WEBSITEJust what
it needs.Less exposed. Fully alive.
it needs.Less exposed. Fully alive.
Alive on screen.
Beautiful imagery, video and purposeful interaction. Reducing exposure does not mean reducing the experience.
Careful connections.
Forms and AI services get limited permissions. A chat widget shouldn’t become a master key.
Know what went live.
Reviewed changes, a recorded release and a recoverable approved version.
We still repair WordPress and revamp existing sites. We assess what you own before recommending what to keep.
How we reduce exposure—and keep adapting
As threats evolve, our approach evolves with them. We keep reviewing the architecture, relevant vulnerabilities and the controls around it. The aim is fewer exposed entry points, a longer useful life and less avoidable maintenance—not a claim that any website is permanently secure.
We build websites with the smallest practical attack surface: fewer publicly exposed systems, fewer permissions and fewer unnecessary moving parts. A public admin panel, a plugin stack or a live content database should not be there merely because that used to be the easiest way to change a paragraph.
The rules changed. You should not have to discover that after something goes wrong. We separate necessary forms, AI services and editing tools, with limited permissions and their own controls. The aim is a website built to endure on the AI-era internet, with less ongoing maintenance and hardening work than an unnecessarily complex setup. Animation, video and useful interactions still belong when they serve the experience.
Security belongs in the architecture: restricted deployment access, fewer third-party scripts, appropriate security headers, careful integration boundaries, a recoverable approved release and ongoing checks. AI-assisted detection can support that work; it does not replace the basics or make a site immune.
Smaller attack surface does not mean invincible. Hosting, domain accounts, deployment access and any connected services still need protection. A simple page can still load compromised third-party code; restrictive browser security policies are one layer of defence. OWASP explains that risk and protection.
We still repair existing WordPress websites and revamp older sites. We assess what is there before recommending what should stay, change or be rebuilt.
05 / BEAUTY THAT WORKSFROM THE BIG SCREEN TO THE BUS RIDE.
Room to impress.
Built to move.
4K confidence.
Pocket-sized precision.
Use the screen people actually have. Make it fast enough to enjoy. Make it possible to navigate without a mouse or sight.
FORM / FIELDSpaces Process Contact
SPACES WITH PURPOSERoom for
better living.
better living.
Considered spaces.
Made around you.
Designed around life.Light. Space. A reason for every detail.
FORM / FIELDSpaces Process Contact
SPACES WITH PURPOSERoom for
better living.
better living.
Considered spaces.
Made around you.
Designed around life.Light. Space. A reason for every detail.
Every size matters.
Spacious large-screen layouts and thoughtful phone layouts, with no sideways hunting for the content.
Beauty without the drag.
Responsive modern images, carefully loaded video and motion that earns its place.
More people invited.
Useful headings, labelled controls, visible focus and motion you can switch off.
What we look for in a properly considered build
A large monitor should not get a phone-sized strip marooned in the middle. Layouts, imagery and typography should adapt to the space, while reading lines stay comfortable. Phones and tablets need deliberate portrait and landscape layouts too.
We use fluid sizing with sensible minimums and maximums, then check the actual result. “Responsive” needs to describe how it behaves, not just appear on the quote.
Modern formats such as AVIF, correctly sized image variants and sensible loading priorities let us balance detail with transfer size. A phone shouldn’t download a desktop-sized image just because it exists.
Animation should give a page life without burying the content, wasting battery or ignoring reduced-motion preferences. Keyboard users and screen readers need useful structure and working controls.
Distinct services deserve useful individual pages: what you do, who it helps, evidence of the work and answers to real questions. Titles, headings, internal links and relevant local information help people and search engines understand them.
Relevant articles, credible mentions and appropriate off-site activity can support those pages. Mass-produced suburb copies and indiscriminate link drops are not a strategy.
Performance and accessibility need testing against the finished site. We agree measurable checks for the build; a file format or a “fast” label does not prove the result.
06 / GETTING FOUNDLAUNCH IS A STARTING LINE.
Make them look.
Help them find you.
A website can be a beautiful destination for people holding your business card. If it needs to win new enquiries, it needs a discovery plan too.
Own a useful answer.
Individual service pages, genuine local relevance and content built around what customers need.
Be clear enough to quote.
Accessible, useful, credible information. No magic file or guaranteed AI recommendation.
Keep earning attention.
Research, content, improvements and measurement. The invoice should buy work you can understand.
What ongoing SEO and AI-search work involves
A website can earn its keep as a showcase for referrals and people with your business card. If that is its job, we’ll say so. You don’t automatically need a monthly marketing campaign.
But if the brief is “bring us new enquiries”, the work doesn’t end with the build. Competitors publish, customers ask new questions and your services change. Visibility needs a plan, a realistic budget and ongoing attention.
You’ll hear AI SEO, AEO and GEO. We call it helping your business become a useful, credible answer. For Google’s AI features, the familiar SEO foundations still apply; Google says there are no special additional optimisations required. Read Google’s guidance.
We cannot order an AI service to recommend you, guarantee a citation or buy you an organic ranking. We can improve the information, technical access and evidence those systems and your customers encounter.
- Research the services, questions and locations with a credible opportunity.
- Improve service pages, internal links, mobile performance and crawl access.
- Publish useful answers and real project evidence—not piles of interchangeable suburb pages.
- Keep business details and eligible local profiles accurate.
- Build a relevant social content plan where it supports the agreed goal.
- Review search visibility, available AI referral data and qualified enquiries; adjust the next month’s priorities.
You receive an agreed scope and an account of work done. Security care and marketing are separate responsibilities, even when packaged together.
07 / ARE WE A FIT?AN HONEST NO IS PART OF THE SERVICE.
We won’t promise the earth.
Then hand you a tennis ball.
A few great suburbs may be a better opportunity than an entire city.
We research the market, competition and budget before recommending marketing. If we can’t see a credible opportunity, we say so. We don’t take the money and hope you stop asking.
Judgement.
Craft. Straight answers.
Clear scope, deliberate design, technical care and honest reporting. Advice about what your business actually needs.
Your business.
Your goals. Your trust.
Real knowledge of your customers, timely content and decisions, and room for professionals to do the work you hired them for.
How we decide whether marketing makes sense
If we cannot see a credible opportunity at your budget, we will tell you before taking your marketing money.
First we look at the industry, the services you want to sell, where you want to work and who already earns the attention. Then we look at your budget, starting position and the effort needed.
Sometimes the sensible target is a handful of valuable suburbs and a few specific services. That can be far more useful than chasing an entire city because the big keyword looks impressive in a sales pitch.
Those suburbs are a research question, not a ranking guarantee. A desirable postcode can still be fiercely competitive. We need evidence of a route in.
If the numbers don’t add up, we decline the campaign or recommend a smaller, better-defined brief. We don’t take the monthly fee and save the bad news for later.
If an agreed campaign stops making sense, we review it with you. You should hear what changed, what we have tried and whether the next investment is justified.
Clear scope. Honest reporting. No guaranteed page one. No guaranteed AI recommendation. Ambition is welcome. Make-believe is not.
The experience behind the work
Our founder’s background includes a computer science degree, a graduate diploma in multimedia, 20 years of experience and the last three focused on AI. That combination brings design, engineering and business judgement to the same brief.
At hourly rates of $120–$240, $500 represents roughly two to four hours of specialist time, before other project costs. It is a comparison of scope, not a claim that every provider works at our rates.
Talented newcomers can build excellent work. The question is not their age or whether they use AI. It is whether they know what to specify, what to verify, where the risks sit and how to maintain the result. AI can make the work faster. It cannot make an incomplete brief complete by wishful thinking.
You bring the business knowledge. We bring the design and technical judgement. We agree the goals and direction together, then take responsibility for how the build meets them. Nothing added just to look clever. Nothing important omitted just to make the quote look cheap.
Within Sunburst Digital Group, Website Rescues focuses on website assessment, hardening, recovery and ongoing care. Our AI Team Member work adds practical experience with conversational tools and business integrations. Those disciplines inform the build; any connected feature still needs a useful purpose, explicit permissions and proper testing.
08 / FROM FIRST CONVERSATIONA BUILD WITH A PLAN BEHIND IT.
Good work.
No mystery.
- 01
Find the fit.
We ask what you want to achieve, what you can invest and whether we’d make a good team. You bring the business knowledge; we bring the design and technical judgement. Questions are welcome. Trust in the expertise you’re hiring is essential. We explain our recommendations, but we won’t compromise the work to follow assumptions that don’t hold up. If that fits, we start with what your budget can realistically achieve and aim bigger as more work comes in.
- 02
Set the brief.
We assess what your business needs and present a clear, considered brief: what to build, why it belongs, what it costs and how it will be cared for. Every recommendation has a reason. No choices for the sake of choices.
- 03
Build. Check. Attack. Refine. Harden.
Bring the design to life. Check the experience. Run authorised attack simulations, fix what they expose and harden the build. Retest before release.
- 04
Launch with a future.
Set a realistic ongoing budget for care and growth. Know who looks after the site, how it will be recovered if something goes wrong and how progress will be measured.
THAT’S WHAT I’M HERE FORYou know your business.
You know your business.
I’ll handle the website.
You shouldn’t need to teach yourself web development to hire someone who knows their craft. Tell me what you want to achieve. I’ll explain what you need, why it matters and what it will cost.
A cheap yes can become an expensive mistake. I won’t do the bare minimum because you don’t know what’s missing, sell you extras you don’t need, or quietly implement a bad decision just to win the job. If something will work against you, I’ll explain why and recommend a better way.
You don’t tell your mechanic every check to make or your accountant every obligation to consider. You hire them for the things they know that you don’t. Your website deserves the same professional responsibility. Accessibility, responsive layouts, performance, appropriate security protections and a plan for ongoing care belong in the recommendation by default. You shouldn’t have to know the technical terms to get the essentials.
I build sites I’m proud to put my name to: considered, tested and equipped for the job we’ve agreed they need to do. I want you proud enough to recommend me, and I want to showcase your site here—with your permission. You bring your business knowledge. I take responsibility for the website work, explain what’s included and make any limits clear.
Want to understand more? I’ll send you explanations in plain English. Want to get on with running your business? That’s why you’ve hired me.
Tell me what you want to achieveIs every $500 website bad?
No. A small, clearly scoped site may be exactly right. Compare what is included, who owns it and what happens after launch. Price is not a security test or a quality certificate.
Can I still change my words?
Yes. Our recommended approach is to make text changes through us. Tell us what you want to say, and we’ll shape the wording to keep your message clear, fit the layout and support the page’s SEO strategy.
That also avoids adding a client-facing editor and the extra attack surface it creates. If you need direct editing access, we’ll scope it separately and put controls around who can use it, what can change and how updates are checked before publication. Those controls reduce risk; they cannot guarantee an editor will never be exploited.
Can you guarantee page one or AI citations?
No. We research the opportunity, agree the work and report the evidence. Search engines and AI services decide what they show.
Do I have to pay for marketing every month?
Yes—if you want us actively working to generate leads through your website, budget for marketing every month. Getting found is ongoing work, not something finished on launch day. For a distinctive business with few competitors, the work may start at around six hours a month. That is not a general allowance for every business. The time and budget needed depend on your niche, target areas, competition and what competing businesses are investing. A crowded market may need substantially more work. We assess the opportunity before recommending a budget, including whether focusing on particular services or suburbs gives you a realistic way forward. The work covers research, content, technical improvements and performance review to improve search visibility and opportunities for AI citations. Your brief sets out the recommended workload and cost; rankings, citations and lead numbers are not guaranteed.
If you only want an online brochure for people you already refer to it, you may not need a marketing campaign. You will still need to budget for a monthly security-care fee. Hosting, security maintenance, off-site backups and monitoring such as Overwatch are ongoing responsibilities, even for a small brochure site. These costs are separate from marketing and set out clearly before you commit. Security care reduces risk; it cannot promise that a site will never be compromised.
Launch day is the start of the responsibility. Security care means checking for newly disclosed vulnerabilities, applying relevant fixes, watching for unauthorised changes and being ready to recover. These are ongoing jobs, not a box ticked during the build.
An unattended website can become a route for harm to your business and its visitors. Looking normal is not proof that it is safe. Our aim is to reduce that risk and respond when something goes wrong; no provider can promise that a website will never be compromised.
If you also want new customers to find you, we set a separate, realistic budget for the ongoing marketing work.
Already have a website?
A free scan from Website Rescues can give you a starting point. An external scan has limits; it is not a deep audit or proof that a site is clean.
Source-backed explanations are available in the expandable sections. Technical sources reviewed 2 November 2026. Your agreed scope determines what is included.