Turning your list into clients.
Every business on your list has a public system that is broken or about to break. That gives you a genuinely useful reason to get in touch. This guide shows how to use it well — helpfully, credibly and within the rules. Sections 1–5 cover the IT company list; section 5b covers the web designer list.
1 · Reading your list
Each Monday you receive a spreadsheet with one row per firm. The columns that matter most:
- System and what it is — the exact hostname (for example remote.firm.co.uk) and what it does: staff remote access, staff email, client portal, website.
- Status — Expired means it is broken today. Expires means it will break on that date unless someone acts.
- Broken for / first seen — how long the problem has gone unnoticed. Weeks of breakage usually means nobody is monitoring.
- Lapses seen — more than one means the firm has lapsed before. Their current arrangement isn't working.
- Issuer — a paid certificate authority (DigiCert, Sectigo, GoDaddy, GlobalSign) usually means manual renewal: it will happen again next year.
- Other dated items, DMARC/SPF — further work you can offer once you're talking.
- Verified — when we last confirmed the fault, normally that Monday morning.
Work the list in this order: broken staff systems (remote access, email, sign-on) → broken client portals → systems expiring within 14 days → everything else.
2 · Before you reach out
- Check it yourself (30 seconds). Open the hostname in a browser and click the padlock. Know what you're talking about before you dial.
- Check it isn't already your client.
- Check the rules for the channel you're using — see section 8. In the UK, screen phone numbers against the Corporate Telephone Preference Service before calling.
3 · The first call
Ask reception for whoever looks after IT — usually a practice manager, office manager or operations director. Lead with the problem, not your company.
Call · opening
Hi, it's [name] from [your company], a local IT support firm.
I'm calling because the security certificate on [hostname] — that's your [staff remote access] — [expired on / expires on] [date]. When that happens, staff connecting from home get security errors or can't connect at all.
You can confirm it yourself: open the address in a browser and click the padlock.
Is that something your current IT support is already handling?
Call · if they're interested
We can get that renewed and confirmed today. While we're at it, we'd check your other renewal dates — domains, other certificates, email security — so nothing else catches you out.
Would it help if I sent a short summary by email, and we had a quick call tomorrow?
Call · "our IT company handles it"
That's great — it may just be worth letting them know, as it's currently [expired / due on date].
If you ever want a second opinion on how your renewals and monitoring are set up, I'm happy to do a free check. Can I leave you my details?
4 · Follow-up email
Keep it plain text, no attachments, and give them a way to verify without clicking your links.
Email
Subject: [hostname] — security certificate [expired / expires] [date]
Hi [name],
Thanks for your time today. As mentioned, the security certificate on [hostname] (your [staff remote access]) [expired on / expires on] [date]. You can check it yourself by opening the address in a browser and clicking the padlock.
We can renew and confirm it for you today, and check your other renewal dates so nothing else lapses unexpectedly.
[Name] · [Company] · [Phone]
[Company address and registration number]
If you'd rather not hear from us again, just reply and let me know.
5 · LinkedIn
LinkedIn message
Hi [name] — I run a local IT support company and noticed the security certificate on [hostname] [expired on / expires] [date]. It's quick to fix, but it'll be causing staff connection errors. Happy to point your team at what needs renewing if useful.
5b · Web designers: the website list
Your list shows businesses whose website certificate has expired or is about to. Every visitor sees a full-page "not secure" warning — something the owner can confirm in five seconds on their own phone, which makes this the easiest opening there is.
Call · website
Hi, it's [name] from [your studio], a local web design company.
Quick heads-up rather than a sales call: your website, [domain], is currently showing visitors a "not secure" warning because its security certificate [expired on / expires on] [date]. Most people leave a site when they see that.
You can check it on your phone right now. Is someone already sorting it for you?
Email · website
Subject: [domain] is showing visitors a "not secure" warning
Hi [name],
Your website, [domain], is currently showing a full-page security warning to visitors because its security certificate [expired on / expires on] [date]. You can see it by opening the site on your phone.
It's usually a quick fix. If whoever looks after your site can't sort it, I'm happy to — and to check nothing else on the site is about to lapse.
[Name] · [Studio] · [Phone]
[Company address and registration number]
If you'd rather not hear from me again, just reply and let me know.
What to offer next: fix the certificate quickly (free or a small fixed fee), then offer a hosting and care plan with automatic renewals, then — where the site is dated — a refresh or rebuild.
6 · From fix to contract
- Solve the immediate problem — free or at a small fixed price. Speed earns trust.
- Offer a renewal and security check of their other dated items (the list shows how many we found).
- Propose ongoing support or monitoring, using what you found as evidence of the gap.
- Look for the bigger project. Firms running their own email server or remote-desktop gateway are often candidates for a migration.
7 · Do and don't
Do
- Lead with the fault and how to verify it
- Be specific: hostname, date, impact
- Offer to help even if they have IT support
- Respect "no" and opt-outs immediately
Don't
- Say or imply you've "hacked", "tested" or "accessed" anything
- Pretend to be their current IT provider
- Exaggerate the risk or invent urgency
- Share or resell the list
8 · Outreach rules (summary)
This is a practical summary, not legal advice. You are responsible for your own outreach; if you're unsure, take professional advice.
United Kingdom
- Live calls to businesses are allowed unless the number is registered with the Corporate Telephone Preference Service (CTPS) or TPS, or the business has told you not to call. Screen numbers first.
- Automated or AI-voice marketing calls need prior specific consent. Don't use them for cold outreach.
- Email to limited companies and LLPs is generally allowed if you identify yourself and offer an easy opt-out. Sole traders and ordinary partnerships need consent first — call them instead.
Ireland
- Business marketing calls and emails are governed by the ePrivacy Regulations. Respect opt-outs, identify yourself, and check numbers against the opt-out register before calling. Take advice for your situation.
United States
- Email: CAN-SPAM requires accurate sender details, a physical postal address, a clear opt-out, and honouring opt-outs within 10 business days.
- Calls: live business calls are generally permitted. Don't use autodialers, pre-recorded or AI-voice calls, or texts to mobile numbers without prior consent, and honour do-not-call requests. State rules can add requirements.
Canada
- Email: Canada's anti-spam law (CASL) is strict. Commercial emails need consent; for business outreach this is usually "implied consent" — for example, where the recipient has conspicuously published their business email address, hasn't said they don't want marketing, and your message is relevant to their role. Identify yourself, include a postal address and an unsubscribe option. Take advice if unsure.
- Calls: check the National Do Not Call List rules and honour do-not-call requests.
Australia
- Email: the Spam Act requires consent; inferred consent can apply where a business address is conspicuously published and your message relates to the recipient's business role. Identify yourself and include a working unsubscribe.
- Calls: respect the Do Not Call Register where it applies and honour opt-outs.
New Zealand
- Email: the Unsolicited Electronic Messages Act requires consent, which can be inferred from a conspicuously published business address where the message is relevant to the recipient's business. Identify yourself and include a working unsubscribe.
Questions about your list? Email lapsewatchltd@gmail.com.