Sites that load fast and convert
Custom builds and integrations
Bounded, auditable, human-approved
Being found, staying fast, staying safe
Almost every compromise we are called in to clean up began with an automated scan that had never heard of the business. It found a plugin version, matched it against a public list of known vulnerabilities, and tried the exploit — the same way it does to a few million other addresses that day.
This matters because "we're too small to be a target" is the most common reason sites go unpatched, and it misunderstands the threat entirely. You are not a target. You are a result. The panel on the right is ordinary background noise that every public site receives.
Move over the perimeter ↓Reality
Not by anything sophisticated. These six account for the overwhelming majority of what we are asked to clean up, and every one is preventable with unglamorous work.
A vulnerability is disclosed publicly and patched upstream. Automated scanners begin looking for unpatched installations within hours. Yours updates monthly, if someone remembers.
The gap: between the fix existing and you having it.
An administrator used the same password on a service that was breached years ago. It appears in a credential list, gets tried against your login form, and works.
Countered by: two-factor authentication, entirely.
Eleven admin accounts, four belonging to people who left, one to an agency you stopped working with in 2022. Any of them is a full compromise if it is reused elsewhere.
Fix: quarterly access review, five minutes.
A plugin whose author stopped updating it three years ago, still installed because something might depend on it. It will never be patched again.
Rule: unmaintained means removed, not disabled.
Compromise through the control panel, FTP or a neighbouring site on shared hosting. The site itself was fine; the way in was underneath it.
Often missed: because everyone audits the site.
A convincing email, a phone call about an expiring domain, a "developer" needing temporary access. No technical control stops this on its own.
Reduced by: two-factor and a rule about who can grant access.
Interactive
Seven stages, composited from the cleanups we have done. Step through it — and at each stage, apply the one control that would have ended it there.
The uncomfortable part is stage seven. In a typical case the business finds out weeks after the compromise, and not from their own systems — from Google, a customer, or a payment processor. Everything before that point was quiet.
Interactive
When a vulnerability is disclosed, the patch and the exploit usually become public at roughly the same time. What decides your risk is how long you then take to apply it.
The arithmetic below is deliberately simple: if you patch every thirty days, then on average a fix exists for fifteen days before you have it. Assume six advisories a year touch something you run — a conservative figure for a site with twenty components — and the exposure adds up quickly.
Coverage
Security is a set of habits with some tooling attached, not a product you install. The tools below support the habits; none of them replace them.
Platforms hardened
Perimeter & transport
Access & secrets
Testing & monitoring
The work
Ordered by how much risk they remove per hour spent. The first two are free and are the ones most often skipped.
On the site, the host, the domain registrar and the email account that can reset all three. Credential stuffing is the second most common route in and this closes it almost completely.
Free, an afternoon, largest single reduction
Most people with an administrator account do not need one. Editors edit, authors write, and the number of accounts that can install code stays very small.
Also free, and rarely done
Updates applied on a defined cycle with security releases expedited, staged first so applying them is not a gamble. Advisories tracked for the specific components you run.
The single biggest ongoing lever
A web application firewall, rate limiting on login and checkout, and blocking the automated noise that makes up most of the traffic in the hero panel.
Buys time; does not replace patching
Alerts when code changes outside a deployment, when a new administrator appears, or when the site starts serving content nobody wrote. This is what compresses "weeks" into "minutes".
Where detection time actually comes from
Off-site backups you have actually restored, a written plan for who does what, and enough logging to answer what was taken rather than guessing.
The control that works when the others did not
Honesty
Security marketing runs on absolutes, and absolutes are the clearest sign that somebody is selling rather than explaining.
Nobody can promise that, including the firms that do. What is achievable is a much smaller attack surface, a much shorter detection time, and a recovery that works.
Security plugins help with specific things and add code that itself needs patching. Several well-known ones have had serious vulnerabilities of their own.
Removing the malware without finding the way in produces a site that gets reinfected, often within days. Root cause first, cleanup second.
A web application firewall buys time against known patterns. It is a mitigation while you patch, not an alternative to patching.
The hardening lasts; the patching does not. A site secured today and left alone for a year is a site with a year of unapplied fixes.
We harden, patch, monitor and recover. For formal penetration testing or a compliance-driven audit, you want specialists, and we will say so and suggest where to look.
Scope
A review first. Most sites have two or three findings that account for most of the exposure, and they are usually free to fix.
Everything installed, its version, whether it is still maintained, and which known advisories currently apply to what you run.
Every account on the site, host, registrar and any connected service — who they belong to, what they can do, and which should not exist.
Enforced across the site and, importantly, the accounts that could be used to reset access to it.
File permissions, disabling in-dashboard code editing, security headers, transport configuration and removing unnecessary exposure.
Firewall rules and rate limiting configured for your traffic rather than switched on at defaults and left.
File integrity, new administrator alerts, outbound content checks and uptime — so a compromise surfaces in minutes rather than from a customer.
Off-site, versioned, and restored into a scratch environment to prove recovery works before it is needed.
Written, short, and specific: who is called, what is isolated first, who tells customers, and in what order.
If something is already compromised: contain, find the entry point, remove persistence, rebuild what cannot be trusted, then close the hole.
Questions
Nobody targeted you. Automated scanners sweep the entire public internet looking for known vulnerable versions, and they do not know or care what your business does.
Small sites are also attractive precisely because they are less likely to be monitored — a compromised site is useful for sending spam, hosting phishing pages or injecting links regardless of how much traffic it gets.
Contain first — take the site offline or into maintenance, change credentials, preserve logs before anything is overwritten. Then find the entry point, because cleaning without that produces reinfection.
After that: remove persistence, rebuild anything that cannot be verified as clean, restore from a known-good backup where appropriate, and close the original hole.
It helps with some things — login rate limiting, basic scanning, some hardening defaults. It does not patch your components, review your accounts or verify your backups.
It also adds code with privileged access to your site. Several popular security plugins have had serious vulnerabilities disclosed in their own code.
It can, which is why changes are staged and tested rather than applied live. Disabling file editing, tightening permissions and adding security headers are all capable of breaking a badly built integration.
Anything we cannot safely apply gets documented as a known exposure rather than quietly skipped.
A care plan keeps you patched, monitored and recoverable on an ongoing basis. This is the deeper one-off work — the audit, the access cleanup, the configuration hardening, the incident plan.
Most sites want the second once and the first continuously.
If you take card payments, staying with a hosted payment provider keeps most of the burden off your site. If card data touches your servers, the requirements change substantially.
For personal information, Canadian privacy law expects reasonable safeguards and, in some circumstances, breach notification. Both are worth specific advice rather than a paragraph on a web page.
The review is typically a week. The fixes depend on what it finds — two-factor and access cleanup are usually same-day, while configuration hardening and monitoring take longer to do carefully.
If something is actively compromised, containment happens immediately and the rest follows.
They handle their layer — the server, the network, sometimes a firewall. Almost none of them patch your plugins, review your admin accounts or notice a new file appearing in your uploads directory.
It is worth asking exactly what is covered, in writing. The answer is usually narrower than assumed.
Call back
Leave a number and a good time. We will call you back to talk about what you are trying to build — no charge for the conversation.
Or call us directly +1 (647) 385-5532