website security services
Website security services that shut the open doors first
- A security audit, written up with the most urgent door first
- Every door the free site check flagged, closed
- Plugins and user accounts with no reason to stay, removed after you approve
- Security headers added, and SSL that renews itself
- Weekly updates, each after a fresh backup and a staging test
- Logins, file changes and uptime watched, with alerts reaching a person
- A monthly report covering updates, catches and the next job due
Overview
What my website security services close, and keep closed
Website security services, as I run them, shut the doors into your site before anyone uses one. The usual way in is an outdated plugin, so the doors below get closed first, and the updates come after.
Once those are shut, the job becomes keeping them shut. Updates go in once a week. A fresh backup comes before each round, and each change gets a staging trial first. Logins and file changes are watched, and when something looks wrong the alert lands with a person.
I do this for WordPress and WooCommerce sites, and for Next.js and Node builds.
- Exposed usernames and XML-RPC, closed
- A readme and debug log anyone could read, taken out of public view
- Directory listing switched off, and the missing security headers added
- Plugins and user accounts with no owner or purpose, removed
- SSL set up to renew itself
- Website security monitoring on logins, file changes and uptime, with a person reading every alert
What a scope from me looks like
WordPress security services, written into a scope
Included
- A security audit, written up with the most urgent door first
- Every door the free site check flagged, closed
- Plugins and user accounts with no reason to stay, removed after you approve
- Security headers added, and SSL that renews itself
- Weekly updates, each after a fresh backup and a staging test
- Logins, file changes and uptime watched, with alerts reaching a person
- A monthly report covering updates, catches and the next job due
Phase two
- Malware removal, if the audit finds the site already infected
- A rebuild, if the theme and plugins can't be brought up to date
- A move to another host
Not doing
- Sites on Wix or Squarespace
- A promise that the site can never be hacked
The audit comes first, and the scope is written from what it finds. Anything the audit turns up outside that scope gets its own quote before anyone touches it.
You sign the scope. From then on, the monthly report lists the work line by line against what you signed.
Process
Securing a site that hasn't been hacked yet
Four of these steps happen once. The fifth is the routine that keeps the site where the first four left it.
- 01
What the site runs on
We talk about the platform and the host, and about who built the site. I also ask whether anyone has broken in before, because that history shows me where to look first.- You
- Tell me the platform and the host, and anything odd you've noticed lately.
- Get
- A first idea of where the open doors are
- 02
The security audit
I run the free WordPress site check from outside, then go through the plugins, the user accounts, the theme and the hosting settings from inside. The write-up lists each open door in order of risk.- You
- Admin, hosting and domain logins.
- Get
- A written audit and a scope to sign
- 03
Shutting the doors
A backup is taken first. Each fix from the audit is made on a staging copy and checked there before it reaches the live site.- You
- Approve each plugin or account I want to remove.
- Get
- A live site with the audit's doors shut
- 04
Proving the alarms work
I set off each alert on purpose to prove it reaches a person. I also restore a backup onto a spare copy, to prove the backup can be used.- You
- Click through the pages your customers use and confirm nothing broke.
- Get
- An alert test and a restore test, both passed
- 05ongoing
The weekly round
Updates go in after a fresh backup, on staging first. Between rounds the logins and file changes stay watched, and the month closes with a report.- You
- Tell me before anyone new is given an admin login.
- Get
- The monthly report
- What the site runs on
- The security audit
- Shutting the doors
- Proving the alarms workboth
- The weekly round
Why it matters
Why I take things away before adding anything
My approach is to remove before I add. Every plugin and every admin account is one more door somebody has to watch. So the ones nobody uses come out first, and only then do I look at what the site still needs.
A security plugin on its own isn't the whole job. Updates and access matter just as much. A plugin can't do the weekly updates for you, and it can't tell which of your admin accounts still belong to someone.
The opening round is the part that runs longer than people expect, on a site left without updates for a long while. Plugins that have fallen far behind are brought forward on the staging copy, and the pages are checked after each one.
Then the routine takes over.
Who sees the alert
Support is the whole team, not one person — reach us any time, and someone picks it up.
Comparison
Prevention or cleanup: which one your site needs
For a site that's working today, prevention is the right place to start. Cleanup only comes into it once something has got in.
If the site already shows spam pages, sends visitors somewhere strange or carries a browser warning, the job is cleanup. That lives on malware removal.
| CRITERION | Website security | Malware removal |
|---|---|---|
| When it starts | While the site is still clean | After something has got in |
| Where it begins | An audit of the open doors | The last clean backup, if one exists |
| Which doors it shuts | The ones nobody has used yet | The one the attacker used |
| Accounts and passwords | Accounts that shouldn't exist, removed | Every password changed |
| What you receive | A monthly report | A plain-language note on what happened |
Client feedback
Clients who came back for more work
- ★★★★★
“This is the second website he has created for us. He is professional and communicative and delivers beautiful work quickly.”
- ★★★★★
“Very professional Team and well prepared. I will definitly hire him and the team again.”
- ★★★★★
“Sandipan was fantastic to work with. He was professional, responsive, and skilled. I will recommend him and most likely use his services again.”
Pricing
How a security scope is priced
The audit decides the scope, and the scope decides the price. A site with a long list of open doors needs more work at the start than one that has been kept current.
After the first round, the weekly work stays the same size from month to month. The parts that move the number are set out under how a scope is built.
Security can also sit inside a website care plan, next to the rest of the upkeep. If you'd rather keep the routine work separate, website maintenance covers the updates on their own.
Weighing it up
Care, maintenance, management or support. Which one fits?
Next step
Run the site check, then let's talk
Check your site with the free WordPress site check, then bring its findings to the call. That list is where the audit begins.
Is WordPress secure enough for a business website?
- WordPress is secure enough for a business when it's kept current and only the right people can log in. The usual way into a WordPress site is an outdated plugin, not WordPress itself. Weekly updates after a backup, a short plugin list and a short list of admin accounts are what keep a site in that state.
What do your website security audit services cover?
- A website security audit here starts with the free WordPress site check, run from outside the site. The check flags exposed usernames, XML-RPC and missing security headers, among other things. Then the plugins, user accounts, theme and hosting settings are gone through from inside. You get a written list of every open door, most urgent first.
Do I still need website security if I already have a security plugin?
- A security plugin covers one part of website security, and updates and access matter just as much. The plugin doesn't keep the other plugins current, and it doesn't decide who should have an admin login. You can keep the plugin. The routine around it is what the service adds.
What is the difference between website security and malware removal?
- Website security is preventive work on a site that is still clean. The open doors are found and shut, then kept shut with weekly updates and watched logins. Malware removal is for a site that has already been hacked. A clean backup goes back on, the attacker's door is shut and all the passwords are replaced. A hacked site needs the cleanup first and the prevention after it.
Can you promise my website will never be hacked?
- No one can promise a website will never be hacked. Security work lowers the odds, and it makes a bad day shorter if one comes, because the backups are kept off the server and the alerts reach a person. If something does get in, the last clean backup is restored and the way in is closed.
Published · Updated