Sites are not broken into through the front door. They are broken into through a plugin nobody updated. Patching, backups and monitoring are inside the monthly, and when something does happen there is a procedure rather than a panic.
Fixes ship constantly. What decides whether you get hit is whether anybody applies them, and on most SME sites nobody does — because nobody was ever given the job.
Security is not a product you buy once. It is a short list of things somebody has to do again and again, and the only question that matters is whether that somebody exists.
A hacked site is not fixed by deleting the file you can see. It is fixed by finding the way in, and that only works if nobody cleans up first.
That you will never be hacked. Nobody can say that and mean it, and the ones who do are selling you a plugin.
If your site is on a plan, all of the above is already in it and there is nothing to add. If it is not, the two pieces stand alone.
“Our old website was years behind the business. Daniel rebuilt it from scratch and now runs our SEO — one point of contact, and things move without chasing.”
“Daniel set up our store and SEO completely. Within 3 months we were selling consistently online — he handles everything.”
No, unmaintained WordPress is. The software is patched constantly and well. What gets sites broken into is a plugin that stopped being updated two years ago, and that is a maintenance problem wearing a security costume.
We look before we touch anything. The site goes into maintenance, a full copy comes off the server, and only then does the cleaning start, because once you clean you can no longer find out how they got in. Price is fixed after that first look, which is how this work is quoted everywhere.
Server access, the hosting panel and somewhere the backups live that is not the server. Plugins cannot rescue a site that will not start, so a WordPress login on its own is not enough. If those are missing, getting them is the first job rather than the second.
No, and be careful with anyone who does. What is promised is that the routine runs, that the way in gets found and closed, and that you get told what happened in words you can use.
One, configured, not four fighting each other. A stack of overlapping security plugins slows the site down and gives you four dashboards nobody reads. The work is in the routine, not in the logo on the plugin.
Yes, all of it. Updates, backups, hardening and monitoring are what the monthly is for. The audit and the cleanup exist for sites that are not on a plan.
Hardening is one job. Keeping it that way is another.
One call. If it is already on a plan there is nothing to buy, and if something is wrong right now, say that first and we start there.
