The playbook
You've got the opening. Here's how the job actually runs.
The opening letter tells you why this works, who your prospects are, and what you could charge. This is the part it leaves out: exactly how you get into a client's site, how you protect yourself before you touch a single line, how you let the AI do the fixing, and how a one-time cleanup can grow into recurring work.
Only the moves that matter to this work. Not how to run a business in general — how to run this one. If you haven't read the opening, start there; this picks up where it ends.
Free to start · no card · a single client's fee can cover the paid tiers.
Before move one
What the job actually requires — and what it doesn't.
People talk themselves out of this before they start, imagining they need a studio, a portfolio, a team. They don't. The whole kit fits on a napkin.
The entire toolkit
That's it. No code on your part, no website of your own, no client list to buy. Both tools are free to start; if you land a client, that first payment is designed to cover upgrading them to the paid tiers — so you needn't be out of pocket to begin.
Everything below is the sequence that turns those two scans into a service you can charge for.
Move one · Prospects
Pick a market — any market — and list ten.
Here's the freedom in this: "local" describes the client, not you — and it's really just shorthand for anyone with a website that sells something. Brick-and-mortar is the obvious half — dentists, gyms, cafes, law offices, contractors, salons — but it's just as true for the online sellers: e-commerce shops, course creators, membership sites, and influencers with a storefront. If a site takes money and runs tracking pixels, it's exposed. You, meanwhile, can be anywhere — a spare room, a city you've never visited, the passenger seat of an RV. You never have to meet a client in person or touch a site from the same zip code.
So pick a market. Your own town if you like the warm-intro edge — knowing a few of them never hurts — or a city three time zones away because it has the businesses and the money. List ten. Cold works fine: you're not cold-selling, you're warning, and a real warning lands from a stranger just as well as from a neighbor.
Don't skip the sellers with an audience
An influencer or creator is a special kind of prospect.
Anyone running an online store, a course, or a merch drop is firing the exact tracking pixels these privacy suits are built on — often more of them, since their whole model runs on ad tech. The exposure is real, and usually heavier than a quiet local storefront. And there's an upside no dentist can offer: a creator who's thrilled with your work can say so to their entire audience. One happy influencer client is a potential source of large-scale free exposure and warm referrals at scale — not a promise, but a door a storefront-only client never opens.
How to scan — the two tools behave differently
- ForensicConsent (privacy) — near-instant, so run it twice.
Fire it the moment the page loads, then again a few seconds later. Some trackers lazy-load and only send data after a beat — the second look catches the ones the first one misses.
- WCAGcheckr (accessibility) — slower, and worth it.
Give it the couple of minutes it takes to do a thorough free pass. That patience is what produces a grade you can stand behind.
Write down each site's A-to-F grade and lawsuit-risk score. With 95.9% of sites already failing, a clean result is rare.
Pick the templated ones on purpose
The best prospects run on WordPress, Wix, Squarespace, or Shopify.
Two reasons. They're the easiest to get into and fix — the access is a login, not a server. And — the one that matters — they're the sites that quietly undo their own fixes every time the platform updates. That's not a headache; it's the reason a client can still need you a year from now. Hold that thought for move seven.
Move two · The opening message
One honest sentence starts every job.
You don't pitch. You warn — plainly, the way you'd want to be told. The channel doesn't matter; the honesty does. Here's a version ready for each one:
- In person or by phone
"Ran a quick free check on your site and found a few of the exact issues the lawsuit bots look for. Want me to walk you through it? No charge, no obligation."
- Cold email
Subject: quick heads-up about [Business]'s website — "Hi [name], I ran a free scan on [site] and it flagged a few of the accessibility and privacy issues the demand-letter firms hunt for. Nothing you need to panic over, but worth seeing. Happy to send the report over — no charge and no obligation. Want it?" (Or drop in your own outreach email — the one in the video descriptions works well here.)
- DM or text
"Hi [name] — ran a quick free scan on [site] and it flagged a couple of the issues those website-compliance law firms look for. Want me to send you the report? No charge."
The report itself is simple: a screenshot of the scan showing their site and its grade. That one image does the persuading — you're just the person who looked.
Then be ready to move. A scared owner may say yes instantly, so have the report and your next question queued before you send. You're not arguing they have a problem — the scan already proved it. Whether you're across the street or across the country, your only job here is to be the calm outsider who caught it before a law firm did.
Already got a demand letter? That owner is your hottest lead, not a lost one — motivated, worried, and looking for someone who can help today.
Move three · The quote
Turn the grade into clean line items.
Once they've seen the report, the quote writes itself. A few things an owner understands in one breath:
What you put in front of them
Illustrative — your market sets the numbers. The do-it-yourself option lowers the barrier for a cautious owner: they still pay you for the plain-English, platform-specific instructions; they just run the fixes themselves. The watch is where move seven comes in.
Anchor it against the alternative: overlay widgets run $490–$3,990 a year and got the FTC's #1 vendor fined a million dollars because they don't actually work. You fix the site for real and hand over proof — for less.
Move four · Access, done like a pro
Get into the site — and back it up before you change a single line.
Here's the step nobody spells out. "The AI writes the fix" is true, but the fix has to land somewhere — which means you need access to the client's site, and you need to protect their site before you touch it.
Getting access — by platform
- WordPress
Ask for an Administrator login, or files via the host (cPanel / SFTP). Make edits through a child theme or the relevant plugin so a theme update can't wipe them — and note which template each fix lives in.
- Wix / Squarespace
Ask to be added as a contributor/editor. You get more room than people assume: custom code in the header/body (consent banners, tag and tracking fixes, scripts), custom CSS (contrast, focus styles), and alt-text fields are all yours. The hard limit is the platform's own generated markup and ARIA — you can't hand-edit those, so a handful of structural accessibility issues you reach only through the platform's built-in accessibility settings, or not at all. (On Squarespace, checkout pages take no custom code whatsoever.) Fix everything you can, and be upfront about the rest.
- Shopify
Get a staff invite, then Online Store → Themes → Edit code. Duplicate the theme first and work on the copy, so the live storefront never wobbles while you work.
- Hand-coded / other
SFTP, Git, or the host panel. If there's a staging environment, that's where you work; if there isn't, you make one by copying the files down.
One shortcut worth knowing: a lot of the privacy problems trace back to a tag manager — Google Tag Manager and the like — quietly loading everything else. When that's the case, you fix it once at the source (the consent setup and the tag triggers) instead of hunting through the theme, and it usually works no matter what platform the site is built on. The fix list flags when the trouble is coming from there.
The rule that separates a pro from a disaster
Download and back up the original first. Every single time.
Before you apply one change: pull a full copy of the site as it exists right now — export the theme, SFTP the files down, trigger the host's snapshot, or use the platform's own backup. Date it. Keep it.
Why it's non-negotiable: if a fix breaks a layout or a booking form, you restore the original in minutes and nobody ever knows there was a wobble. Work on a copy or staging where you can, test, and publish only once it holds. This one habit is the entire difference between "the expert who cleaned it up" and "the person who took my site down."
Move five · Let the AI do the work
Paste the fix list. Review. Publish.
This is the part that feels like cheating. Both extensions don't just find the problems — they hand you a precise, AI-ready fix list: a ready-to-paste prompt that names the exact issues (right down to which trackers fire before consent, and where they load from), spells out the fix step by step, and even includes the test to confirm it worked.
- Export the fix list
From WCAGcheckr and from ForensicConsent. Each one is addressed to an AI — a complete brief it can act on directly, not a report you have to translate first.
- Hand it to your AI — and name the platform
Paste it into Claude or whatever you use, and tell it which platform the site runs on (WordPress, Shopify, Wix…). Ask it to tailor the fix to that platform, and you get instructions that match the exact screens the client's site actually has, instead of generic ones you have to translate. It writes the alt text, the ARIA labels, the contrast corrections, the consent configuration — the actual code.
- Apply it to your backup / staging copy
Never straight to live. Drop the corrections into the copy from move four.
- Test, publish, then re-scan until it's clean
Click through the pages the fixes touched — does everything still work? Publish. Then re-scan: the prompt spells out exactly what to check, so you keep going until a fresh scan comes back clean — grade A, zero trackers firing before consent. On ForensicConsent, scan twice with a few seconds between — that catches any tracker that lazy-loads its data send after the page settles.
You review and deliver. Most of the labor is automated; all of the trust is yours. To the client, you're the expert who found what nobody else caught and made it vanish — they never need to know how light the lift actually was.
Move six · Proof
Hand over evidence, not promises.
Anyone can say "it's fixed." Your edge is that you can prove it. After the re-scan comes back clean, generate the sealed, timestamped, independently-verifiable proof from both tools and deliver it alongside the before-and-after grades.
That document is the whole point. The shakedown's leverage is "you're non-compliant and you can't prove otherwise." You just handed the owner court-grade evidence that erases exactly that. If a letter ever does land, they can show they acted in good faith the moment they were aware.
What you actually delivered
Not a subscription to a widget that gets them sued anyway. A site that's genuinely cleaner, and a verifiable record that says so. (Not legal advice — but ask any defense attorney what provable, same-day remediation does to a "pay us or else" letter.)
Move seven · The watch — this is the business
Why a fixed site doesn't stay fixed — and why the watch is the recurring part.
Remember move one: most small sites run on templated platforms. Here's the thing those platforms do that can turn a one-time job into a recurring one.
They auto-update. A theme pushes a new version. A plugin updates itself overnight. The platform ships a change. And any one of those can silently undo the fixes you made — restore the image that lost its alt text, re-add the tracker you stripped out, re-fire the pixel before consent. No warning. No email to the owner. The site just quietly slides back into the crosshairs, and the next scanner-bot that crawls it finds it wide open all over again.
The owner has no idea. That's the trap — and it's your opening.
The monthly watch re-scans the site on a schedule and catches that regression the moment it happens. Which sets up the move that makes a client need to keep you for years:
The hero moment, on repeat
"Heads up — your platform pushed an update last night that undid the fix on your booking form. I already re-applied it. Here's fresh proof it's clean again."
They never smelled smoke. You'd already put the fire out. That message, a few times a year, is why a $150-a-month watch can feel like the easiest bill an owner pays.
And be honest about what the watch is — that's what makes it defensible. You're not promising a client they'll never be targeted; nobody can promise that. What you're doing is removing the thing the shakedown runs on: keep the site in compliance, and there's nothing left for anyone to point at. Good-faith, provable, ongoing — that's the whole value.
On a living, auto-updating site the work is never permanently done. So the watch isn't padding — it's the part that actually keeps the site compliant, and it's what makes this a service with recurring revenue by design rather than a string of one-off jobs.
Then do it again
Client two is the same seven moves.
Nothing about the second client is new. Same scan, same message, same quote, same backup-and-fix, same proof, same watch. The one-time fees cover your time and the tools; every watch you set up is recurring by design, so the work can build on itself instead of resetting to zero with each job.
Your prospect list is every small business with a website, in every town you decide to work — and almost none of them have anyone watching their back. You don't have to fix the whole machine. You just have to be the one a handful of businesses — in your town or a town you've never seen — are relieved to have on their side.
Run move one today
Install both, scan one business this afternoon.
The scan takes a minute. The first conversation can happen today. Everything after it is the seven moves above, on repeat.
Free to start · no card · a single client's fee can cover the paid tiers.