Website security starts with reducing avoidable weaknesses
There is no single setting that makes a website secure. The practical approach is to reduce the number of weaknesses an attacker can use, detect suspicious changes and keep a recovery route available if something still goes wrong.
For WordPress websites, routine updates matter because the website usually depends on several separate components: WordPress itself, the active theme, plugins and the PHP environment underneath them. The National Cyber Security Centre recommends installing security updates when vendors release them, including updates for CMS themes and plugins.
Our Essential Care plan costs £59 a month and includes weekly core, plugin and theme updates, security scanning and hardening, daily off-server backups and 24/7 uptime monitoring. These controls address several different failure points instead of relying on one defensive measure.
Older websites can also be held back by an unsupported PHP version or code that no longer works safely on a current release. Our PHP upgrade service is available where compatibility work is needed before the underlying environment can be updated.
Monitoring is useful, but it is not the whole security job
Our standalone Uptime & Security Monitoring plan is £29 a month or £290 a year. It checks website availability every minute and includes malware and blacklist monitoring, SSL expiry monitoring, instant email and SMS alerts, and investigation of every incident.
That is useful for detecting symptoms. It does not replace software maintenance or backups. A malware alert tells you that something may already be wrong, while an update can remove a known software weakness before it is exploited. A backup serves a different purpose again by providing a recovery copy if live files or data become unusable.
The NCSC advises organisations to maintain backups separately from their main systems and to know that those backups can be restored. Our care plans use daily off-server backups, so the backup copy is not simply another set of files within the live website account.
If monitoring is your main requirement, see uptime monitoring. If you need routine technical maintenance as well, website maintenance explains the wider maintenance work.
What website hardening is trying to achieve
Security hardening is about reducing unnecessary exposure and making ordinary compromise routes harder to use. The exact work depends on the platform, hosting environment and configuration, which is why hardening should be treated as technical maintenance rather than a generic promise that a website cannot be hacked.
For a typical content-managed website, the engineer needs to consider software versions, administrative access, file and server configuration, HTTPS operation, known security findings and whether recovery copies exist outside the live environment. Google also recommends secure transfer protocols such as SFTP or SSH instead of unencrypted FTP when administering websites.
Google Search Console should form part of the wider picture. Its Security Issues report can identify hacked content, malware or deceptive pages detected by Google. That information is particularly important because a compromised website may contain injected pages that are not obvious from the homepage or WordPress dashboard.
Security therefore needs maintenance as well as observation. Our WordPress maintenance and WordPress support pages cover the platform-specific options.
Choose prevention, monitoring or hacked website recovery
The appropriate service depends on the condition of the website now.
- Monitoring from £29 a month: suitable when you want 1-minute availability checks, SSL monitoring, malware and blacklist monitoring, alerts and incident investigation.
- Essential Care at £59 a month: adds weekly WordPress updates, daily off-server backups, security scanning and hardening, plus ongoing website care.
- Professional Care at £119 a month: includes everything in Essential Care together with 60 minutes of development time each month and fixes within 24 to 48 hours.
If malware is already present, preventative monitoring is not a substitute for cleaning the compromised site. Our Hacked Site Rescue includes a full malware scan and clean, backdoor removal, post-cleanup security hardening and a Google blacklist removal request where required. The currently published fixed price is £349.
No website security service can sensibly promise that an internet-facing site will never be attacked. The objective is to reduce avoidable exposure, identify problems earlier and maintain a workable recovery position if an incident occurs.