Launch day runbook and DNS cutover checklist
A timed launch plan from T minus 48 hours to the first week, including a DNS cutover that leaves email alone.
Free template for designers
Vulnerability report replies
Two replies for unsolicited security reports: a polite decline for beg bounty emails, and a professional acknowledgement for a genuine, detailed disclosure.
Which reply?
- Beg bounty: asks for payment first, gives no details, findings are generic (missing header, SPF or DMARC, WordPress version).
- Genuine report: names the URL, plugin and version, steps to reproduce and impact, and does not demand money first.
- Either way: do not click links or open attachments. Check the claim yourself with your own tools.
Reply A: Polite decline (beg bounty)
Subject: Re: [their subject]
Hello, thank you for getting in touch. We do not run a paid bug bounty program and do not pay for unsolicited reports or scans. If you believe you have found a specific vulnerability, you are welcome to send the full technical details (affected URL, steps to reproduce and impact) to [security contact]. We review every report and fix confirmed issues, but no payment is offered. Regards, [Name], [Business name].
Reply B: Genuine disclosure
Subject: Re: [their subject] (our reference [SEC-number])
Hello [Name], thank you for the detailed report about [issue, for example the outdated plugin on /page/]. We have confirmed it and are working on a fix, which we expect to complete by [date]. We will email you when it is done. Please do not publish details until then, or until [date], whichever comes first. [We do not offer rewards, or: our reward policy is (summary).] With your permission we would like to credit you as [name or handle] on our [security page or changelog]. If you find anything else, please use [security contact]. Thank you again, [Name], [Business name].
After you reply
- Log the report: date, sender, claim, what you checked and what you fixed.
- Fix confirmed issues: update the plugin, add the header, tighten SPF or DMARC.
- Publish a security.txt file at /.well-known/security.txt with your contact and policy.
- Never pay before seeing details, and never pay twice for the same finding.
More templates
The rest of the kit
Website content collection checklist
Everything a client needs to supply for a new website, with ground rules and a deadline: copy, images with usage rights, brand files, legal pages, form settings and old site details.
Client onboarding questionnaire
Questions to send a new web design client before the discovery call: the business, goals, existing accounts, content and brand, budget and who maintains the site after launch.
Incident log and post-incident report
A running incident log to fill in while a site is down or hacked, plus a short post-incident report for the client: timeline, impact, cause, fix and the changes that stop a repeat.
Scope creep script and change request
What to say when a client asks for “one small thing” outside the project, plus a change request form with real fields.
Care plan tier sheet
Turn your care plan prices into tiers a client can compare: what each tier includes, task credits, add-ons and who may buy them, backups and response times.