Auto Alpha AdvisoryA report on your website lands with fifty findings, each tagged by severity, and a quote at the bottom to fix the lot. The severity tags tell you how bad each finding is. They don't tell you what decides whether a fix is worth paying for: whether the finding can be fixed at all, and by whom.
So before you read the quote, sort the findings by who can fix them, and count the ones nobody can fix first. A quote that prices those as if work could fix them is selling hours, not outcomes.
Severity ranks the work. It can't price it
A high-severity finding might be a broken contact form that one developer clears in an afternoon. It might just as easily be a POPIA question that needs your attorney's view before anyone changes a line of code. Same tag, very different bill. And a low-severity dead link in your footer could be gone before lunch if whoever has the login spends five minutes on it.
Severity is a good way to decide what to do first. Pricing needs a second axis. I'm a CA(SA), and in audit nobody prices a finding before they know who owns the fix, so the axis I use is ownership: who, specifically, can make this finding go away?
Four classes, sorted by who can fix it
Every finding in a read I do goes into one of four classes.
- Class A is copy and configuration: wrong words, dead links, misconfigured records. Anyone with access fixes it in minutes to an hour.
- Class B is engineering. It's real build work, but it sits inside your own team's control and takes days to weeks.
- Class C needs a decision, a budget or a third party, such as counsel, a vendor or a governance choice. Weeks to months, sometimes with real cost.
- Class D can't be fixed. It's a fact about the business, its market or a third party, and no website work changes it.
My own site has a Class D finding. It can't show client results until clients approve them, and my work page says as much: client case studies ship only once the client has reviewed the numbers and approved the write-up. I could rebuild the site three times and that finding would still be open. Anyone who quoted to fix it would be billing me for hours that change nothing.
Count Class D before anything gets a price
My rule is to count Class D before quoting anything. It may be a short list. Count it anyway, because a D finding with a price next to it tells you the quote was priced off the report's length rather than a reading of it.
Then look at Class A. That's usually work someone you already employ can do: your marketing person, your office manager, whoever has the login. If the quote prices forty minutes of copy edits at agency rates, that's a line you can strike.
What the split looked like on two reads
On two full reads in September 2026, 35 of 58 and 39 of 56 findings were Class A or B: work the company's own team could do in hours to weeks. Both figures are published on The Full Read page.
In both reads that's more than half the list. The honest consequence is awkward for anyone who sells remediation, me included. Often the best value is to fix most of it yourself and pay only for what you can't, which might be the engineering your team has no time for, or the Class C items where someone has to chase a vendor or put a decision in front of the board.
In practice that comes down to three moves. Hand the Class A rows to whoever has the login, with a deadline measured in days. Ask your own developer to estimate the Class B rows before anyone outside quotes them. Then take only what's left to an agency, with the Class D count agreed up front so nobody gets paid to chase it.
One finding, three possible owners
Ownership is decided finding by finding, never by category. "Security" is a category, and a category can't fix anything.
Take a missing security header. MDN's reference on Strict-Transport-Security lists it as a response header, so it's sent by whichever server answers the request. On a site you host, that's your server, and the fix is usually a few lines of configuration: Class A. On a platform you rent, the vendor's server answers. The same finding becomes a support ticket and a wait (Class C) or, if the vendor won't change it, Class D.
Rented platforms aren't an edge case. W3Techs has Shopify on 5.3% of all websites, Wix on 4.2% and Squarespace on 2.4%, as of 21 October 2026. A report that files every missing header as engineering work without asking where the site runs is guessing at the class, and the quote inherits the guess.
Who re-checks the count when the seller changes it?
Someone other than the seller. If the person quoting the fix revises the Class D count downwards, moving findings from "can't be fixed" to "fixable", a second reader checks each move. Each finding that leaves Class D is one more thing the seller can price, so the incentive sits with the seller.
It runs the other way too. Moving a finding from A to B turns a free fix into paid work, so every row that becomes a priced line gets a second reader as well. None of this assumes bad faith. A finance team doesn't let the person who raises a payment approve it either, and nobody takes that as an insult. Google's guidance for site owners is blunt about where the risk lands: you're responsible for the actions of any company you hire.
The test to put to any agency
Ask for the findings split by who can fix them, with Class D counted first. If the agency can't split them, it hasn't read them.
That sounds harsh, but a scanner can't do the split on its own. It can see that a header is missing. It can't see who signs off your privacy policy or whether your vendor will budge. W3C's page on selecting evaluation tools says it about accessibility: "Web accessibility evaluation tools can not determine accessibility, they can only assist in doing so." I'd say the same of most automated website checks. They produce the list, and a person still has to read it.
Google Search Central's page Do you need an SEO?, last updated 5 June 2026, gives owners questions to ask before hiring. Two of them belong in front of any website quote: "How do you measure your success?" and "Will you share with me all the changes you make to my site, and provide detailed information about your recommendations and the reasoning behind them?" A class split answers the second before work starts. Re-running the checks finding by finding answers the first when it's done.
If you'd rather not do the split yourself
That's the job of the Platform Remediation door of The Full Read. The read classes every finding by who can fix it. The fee, from R25,000, is credited in full against remediation that starts within 30 days, and the fix is proved by re-running the checks, finding by finding. If you want to start with what the machines see, the free scan scores your site across nine domains, from security to AI readiness (GEO).