Development
Business websites, redesigns and online stores that work well on phones, are easy for your team to update and give attackers as little as possible to work with.
01Who it's for
It suits organisations whose website is dated, slow or hard to update, or that want to sell online or take bookings for the first time.
02What's included
Plan & design
We work out who your site is for, what you want visitors to do and which pages you need. You get a written site map and content plan before design starts.
Page designs for desktop and mobile, built around your brand and reviewed with you before any code is written. We design for accessibility from the start, with readable text, clear contrast and keyboard-friendly navigation.
Launch
We plan the domain move and redirects so existing search rankings and links carry over. You get training on updating content and a handover pack listing every account, licence and setting.
Build & test
We build with OWASP secure coding practices: security headers, HTTPS only, minimal plugins and no hard-coded secrets. Forms are protected against spam and abuse, and admin access uses multi-factor authentication (MFA).
E-commerce sites with product catalogues, checkout and order emails. Where possible we use your payment provider's hosted checkout, so card details are handled by the provider, not your website. That reduces your Payment Card Industry Data Security Standard (PCI DSS) obligations.
The site goes live on hosting set up with secure defaults: least-privilege accounts, HTTPS enforced, and server software, plugins and packages current at launch. You get a short summary of these settings to show customers, insurers or auditors.
03In detail
It is the work of planning, designing, building and launching your website: the pages your customers see and the parts they don’t, such as hosting, forms, admin access and the code that holds it together. At Catharsis, we treat your website as part of your attack surface, because it is.
Secure development designs the common weaknesses out from the start. Beyond HTTPS and MFA on admin access, that means:
We use the OWASP Top 10 from the Open Worldwide Application Security Project (OWASP) as the baseline for what must not go wrong. Our secure development page sets out the standards behind this work, and penetration testing can be added if you want an independent test.
Where your site needs to do more, such as a customer portal or booking system, we combine it with custom software or connect it to your existing systems.
If accessibility is a requirement for your organisation, we can design and build to the Web Content Accessibility Guidelines (WCAG) 2.2 Level AA on request. This often matters for government, council, health and education buyers. You can see sites we have delivered on our work page.
Timing depends mostly on page count, custom features and how quickly content and feedback come back. Content is the most common cause of delay, so we agree early who writes what and plan around it.
04The process
A workshop to agree goals, pages, features and integrations. You receive a site plan and a written quote.
We design key pages for desktop and mobile and refine them with your feedback until you approve them.
We build the site on a private staging address, load your content and check speed, accessibility and security as we go.
Typically 4 to 8 weeks for a small business website
A final review with you, then a planned go-live with redirects in place and the live site checked page by page.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD Essentials | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|---|
| Secure design and build | Not applicable | Not applicable | A.8.25, A.8.28 | Protect (PR.PS-06) |
| Plugins and dependencies kept up to date | Not applicable | Not applicable | A.8.8 | Identify (ID.RA-01) |
| Security requirements agreed at discovery | Not applicable | Not applicable | A.8.26 | Not applicable |
| Separate staging and live environments | Not applicable | Not applicable | A.8.31 | Not applicable |
| MFA on admin accounts | Identity services | Multi-factor authentication | A.8.5 | Protect (PR.AA-03) |
06Pricing
Starting from*
$1,999 ex GST
per project
What changes the price
The final price depends on the number of pages, custom features, e-commerce, integrations and how much content we write or migrate for you.
Not included: hosting, updates and monitoring after launch. You can manage those yourself, or our website care and hosting plans can take them on.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistWebsites start from $1,999 ex GST. A brochure site with a handful of pages sits near that starting point, while a store with hundreds of products, custom features or integrations costs more. Content is a big variable: writing new copy or moving pages from an old site adds time. Once the scope is agreed, the price only changes if you add to it.
Because small business websites are rarely breached by sophisticated attacks. More often the way in is an outdated plugin, a reused admin password or a contact form that accepts anything. A security company designs those risks out from the first day, so security is built in rather than added after a problem.
Not if the move is planned. Before launch we list every page that search engines have indexed and make sure each one either keeps its exact address or redirects permanently to its closest new page. We also carry over page titles and descriptions where they still fit. Rankings can move a little after any launch, but planned redirects protect the traffic you already have.
Yes. We set up an editing approach that suits how often you change content, and we train your team to update text, images and pages without touching code. Where a change needs a developer, such as a new feature or page layout, we can make it for you as a small project or as part of a website care plan.
Security is part of each stage rather than a final check. At discovery we agree what data the site collects and who needs admin access. During the build we follow OWASP practices and keep third-party code to what the site needs. At launch we set up HTTPS, security headers and MFA on admin accounts. If a contract or insurer asks for independent testing, penetration testing can be added as a separate, optional service.
Yes, if you want us to. A website care and hosting plan covers managed hosting, software updates, backups, uptime monitoring and security monitoring, with coverage and response targets agreed in writing. You can also host the site yourself; we hand over every account and credential at launch so you are not locked in.
Talk to our team
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.
