Website Security

Publish SPF, DKIM and DMARC and move DMARC to enforcement so your domain cannot be spoofed. Put phishing-resistant multi-factor authentication on email, admin and payment accounts so a stolen password is useless. Register the lookalike domains. Give staff a one-click reporting route that reaches somebody who acts. Verify every new or changed bank detail by phone on a number you already had. Training helps at the margin, but the technical layers are what actually stop phishing attacks, because a good enough message will always fool somebody. The full order of work is in the six steps above.

Patching the platform and its plugins, hardening the server and the admin accounts, backups the attacker cannot reach, monitoring for unauthorised change, and authenticating the domain so it cannot be used in phishing attacks against your customers. Application-level testing against the OWASP Top 10 sits on top of that for sites that take payments or hold personal data.

No. A plugin runs inside the thing it is protecting, so once the platform is compromised the plugin is running on the attacker's machine. It is a useful extra layer and a poor foundation. The controls that hold sit outside the site: patch discipline, an isolated backup, an authenticated domain, and monitoring that reaches a human.

Take the site offline or into maintenance mode rather than deleting anything, preserve the server logs and a copy of the current state, then rotate every credential the site holds, including database, hosting panel, CMS admin and any API keys in configuration files. Restore from a backup made before the first unauthorised change rather than cleaning the live site, then patch the entry route before it goes back online. The full sequence, including the reporting and insurance steps, is in I got hacked, what should I do.

Security updates within days of release, and automatically wherever the platform allows it. The window between a patch being published and being exploited is now measured in days for popular content platforms, because the patch itself tells attackers where the bug was.

Optionally, and it is the part most worth keeping. File integrity, unexpected admin logins, certificate expiry and uptime, with alerts routed to a person. Monitoring nobody reads is the most common form of website security theatre we find.

Yes. A compromised brochure site is used to host phishing pages, serve malware to your visitors, and send mail from your domain. The attacker wants your reputation and your domain, and both are worth taking even when there is no checkout.

Yes, and it is usually the right split. We specify and verify, your agency implements what they already maintain. We do not resell hosting or plugins, so there is no commercial reason for us to recommend moving anything.