Website security without the fear-mongering
Most small business sites aren't hacked by clever attackers. They're hacked through an old plugin, a weak password or a forgotten admin account. I close those doors, keep backups somewhere safe and set up the protections that stop the automated attacks every site faces.
What I set up
HTTPS everywhere
Certificates that renew themselves, and every page served securely.
Security headers
A content security policy and the headers that stop common browser attacks.
Logins
Strong passwords, two-step login, and admin accounts only for people who need them.
Updates
WordPress, themes and plugins kept current, after a backup.
Backups
Regular copies stored away from your host, and a tested way to restore them.
Bot protection
Cloudflare in front of the site, and Turnstile on forms to stop spam.
If your site has been hacked
Contain
Passwords changed everywhere, the site put into maintenance if it's harming visitors.
Clean
Infected files removed or the site restored from a clean backup, and the database checked.
Close the door
The way in found and fixed, whether an old plugin, a leaked password or a weak setting.
Recover
Google's security warnings reviewed in Search Console, and email deliverability checked.
Security starts with ownership
The worst security problem I see isn't technical. It's a business that doesn't control its own domain, hosting or admin accounts because someone who left years ago set them up. If you can't log in, you can't fix anything. I make sure the important accounts are in your name, with your email and two-step login switched on. More on that on my hosting and domains page.
This website runs with a strict content security policy, no inline scripts and forms protected by Turnstile, so you can see the approach for yourself.
Questions about website security
My site was hacked. What should I do first?
Change the passwords for hosting, the domain registrar, the site's admin accounts and the database, and take a copy of the site as it is for investigation. Then get the infected files cleaned or restored from a clean backup, and find how the attacker got in so it doesn't happen again. I can do all of that with you.
Is a plain HTML site more secure than WordPress?
It has far less to attack: no login page, no database and no plugins. WordPress can be kept secure, but it needs regular updates, strong logins and careful plugin choices.
How do I stop spam from my contact form?
A combination of a hidden honeypot field, server-side checks and a bot check such as Cloudflare Turnstile stops almost all of it without annoying real visitors. The forms on this site work that way.
Worried about your website's security?
Tell me what your site runs on and who has the logins. I'll tell you what I'd lock down first, or help you recover if something has already happened.