Website security: prevent, detect and recover
Gjethe secures websites and web applications: we harden WordPress and custom sites, clean up malware and restore hacked sites, review code and configuration for common vulnerabilities, set up security headers, firewalls and two-factor login, and monitor for problems. We focus on practical protection; formal penetration tests and certifications come from accredited specialist firms.
- Free first consultation
- Written quote for your project
- Flexible payment milestones
At a glance
- Prevent
- Hardening, updates, access control
- Detect
- Scanning and monitoring
- Recover
- Malware clean-up and restore
- Platforms
- WordPress, Shopify, custom apps
Definition
What is website security?
Website security is the practice of protecting a website, its users and its data from attacks, by keeping software updated, limiting access, configuring servers and applications securely, monitoring for intrusions and being able to recover quickly.
Most website compromises aren't sophisticated. They come from outdated plugins, reused passwords, forgotten admin accounts, exposed configuration files and missing backups. Fixing those basics removes most of the risk for most businesses. When something has already gone wrong, speed and method matter: contain, clean, find the entry point, close it and restore trust.
Who is it for?
Sites that have been hacked
Spam pages, redirects, warnings in Google or a hosting suspension. You need it cleaned and fixed now.
WordPress owners
Plugins and themes need regular attention; a hardening pass and monitoring prevent most attacks.
Web applications with user data
Logins, personal data and payments raise the stakes; a security review finds weaknesses before attackers do.
Businesses with customer questionnaires
Clients ask how you protect their data; documented controls help you answer honestly.
What's included, and what you keep
What's included
- Security assessment of site, hosting and access
- Software and plugin vulnerability review
- Hardening of CMS and server configuration
- Admin account clean-up and two-factor login
- Web application firewall set-up
- Security headers and HTTPS configuration
- Malware scanning and removal
- Entry-point investigation after a hack
- Google and blocklist warning removal requests
- Backup set-up and restore testing
- Ongoing monitoring and alerts
- Written report with remaining risks
What you receive
Handed over at the end. Yours to keep.
- Security report: findings, fixes, remaining risks
- Hardened, cleaned site
- Access and account inventory
- Backup and recovery plan
- Monitoring set-up
What happens when we clean a hacked site?
- 01
Contain
Take a full backup for evidence, put up maintenance if needed and change all credentials.
- 02
Investigate
Find malicious files, database injections, rogue users and how the attacker got in.
- 03
Clean
Remove malware and backdoors, replace core files with clean copies and update everything.
- 04
Close the hole
Fix the vulnerability that allowed entry so it can't happen again the same way.
- 05
Restore trust
Request removal of Google and blocklist warnings and check search results for spam.
- 06
Monitor
Watch closely for reinfection in the following weeks.
The basics that prevent most attacks
- Core software, plugins and themes kept updated
- Unused plugins, themes and accounts removed
- Unique passwords and two-factor login for admins
- Least-privilege roles for staff and contractors
- Web application firewall in front of the site
- Automatic off-site backups with tested restores
- HTTPS everywhere and secure headers
- File permissions and configuration files locked down
Security review, penetration test or certification?
| Service | What it is | Who provides it |
|---|---|---|
| Security review (what we do) | Practical review of configuration, code and access, with fixes | Gjethe |
| Penetration test | Formal, scoped attack simulation with an attestation report | Accredited specialist firms |
| Certification (e.g. ISO 27001) | Audit of an organisation's security management system | Accredited certification bodies |
Why small businesses get hacked
Most attacks on small business websites aren't personal. Automated bots scan the internet constantly for known weaknesses (an outdated plugin, a default login page, an exposed backup file) and exploit whatever they find to send spam, host phishing pages or redirect visitors.
That's good news in one way: the same basic measures that block bots (updates, strong unique logins, a firewall and removing what you don't use) protect most sites from most attacks. Security doesn't have to be complicated to be effective; it has to be consistent.
How website security works, step by step
Every step has a clear output you can review. Timing is agreed in your quote.
- 1
Assess
Site, hosting, software versions, accounts and backups reviewed.
- 2
Prioritise
Findings ranked by risk and effort to fix.
- 3
Fix
Updates, hardening, access clean-up and configuration changes.
- 4
Protect
Firewall, headers, two-factor login and backups set up.
- 5
Monitor
Scanning, uptime and change alerts switched on.
- 6
Report
What was found, what was fixed and what risks remain.
Tools, and what shapes your quote
Pricing is based on your project and agreed in your quote. These are the things that move it.
| Factor | Why it matters |
|---|---|
| Current state of the site | A neglected site with many outdated components takes longer to harden. |
| Active compromise | Cleaning a hacked site involves investigation and cleanup beyond normal hardening. |
| Platform | Hosted platforms like Shopify limit what can be configured; self-hosted sites allow more. |
| Custom code | Reviewing custom applications for vulnerabilities takes more time than CMS hardening. |
| Ongoing monitoring | Continuous monitoring is a monthly service on top of the initial work. |
| Area | Tools |
|---|---|
| Scanning | WPScan, OWASP ZAP, dependency scanners, malware scanners |
| Protection | Cloudflare WAF, server firewalls, two-factor authentication plugins |
| Configuration | security headers, Content Security Policy, HSTS |
| Recovery | off-site backups, file integrity monitoring |
Common mistakes to avoid
What we see go wrong most often, and how a good project avoids it.
Restoring a backup without finding the cause
If the entry point isn't closed, the site gets reinfected, often within days.
Shared admin logins
One password used by several people can't be revoked for one of them and hides who did what.
Plugins installed and forgotten
Inactive plugins can still be exploited. Remove what you don't use.
No offline backup
Backups stored on the same server can be encrypted or deleted along with the site.
Frequently asked questions
My site has been hacked, what should I do first?
Change your hosting, CMS and email passwords, don't delete anything yet, and contact us. We take a backup for investigation, contain the damage and start cleaning.
Can you remove the Google 'This site may be hacked' warning?
After cleaning the site, we request a review in Google Search Console. Google decides when to remove the warning, usually after verifying the site is clean.
Do you do penetration testing?
We do practical security reviews and fixes. Formal penetration tests with attestation reports should come from accredited specialist firms; we can help you prepare for one and fix its findings.
Is Shopify or WordPress more secure?
Shopify manages server security for you, so there's less to configure. WordPress can be equally safe when maintained well, but it puts more responsibility on the site owner.
How do you prevent reinfection?
By finding and closing the original entry point, updating everything, removing unused components, enforcing strong logins and monitoring for changes.
Will security work slow down my site?
Usually the opposite. Removing unused plugins and adding a CDN-based firewall often makes sites faster.
Can you help us answer security questionnaires from clients?
We can document the technical controls in place on your website and hosting, which helps you answer accurately. Organisation-wide policies are your responsibility.
Do you offer ongoing security monitoring?
Yes, as part of a maintenance plan: updates, scanning, monitoring and response.
Are backups part of security?
Yes. Reliable, tested, off-site backups are what turn a disaster into an inconvenience.
Can you review our web application's code?
Yes. We review authentication, authorisation, input handling and data exposure against common vulnerability classes and help fix what we find.
How can I tell if my site is compromised?
Common signs are unfamiliar pages in Google results, redirects to other sites on mobile, new admin users, browser or Google warnings, unusual traffic spikes or a hosting provider's notice. We can scan and confirm.
Does an SSL certificate make my site secure?
SSL encrypts traffic between visitors and your site, which is essential, but it doesn't protect against vulnerable plugins, weak passwords or malware. It's one layer among several.
Related services
Website Maintenance & Support
Updates, backups, monitoring and fixes every month.
WordPress Development
Custom themes, plugins and WooCommerce without bloat.
Cloud Deployment
Vercel, AWS, Azure and Google Cloud set up properly.
QA & Software Testing
Manual and automated testing across browsers and devices.
DevOps & CI/CD
Automated pipelines, containers and infrastructure as code.
IT Support
Remote help desk, device set-up and workspace administration.
Website Security by industry
Secure your website.
Tell us what you need. You get an honest assessment, a clear plan and a written quote. The first consultation is always free.
- What happens next
- 1You tell us what you need
- 2We aim to reply within 24 hours with questions
- 3You get a written quote for your project