Security and backups you can restore, not a sticker on the footer

Who this is for

You have a live site, usually WordPress or a store, and you are not sure what would happen if an update failed or an old admin account was still active. You want a named backup and a shorter list of people with passwords. You do not want a compliance certification. We are not an auditor, and we will not print a badge that implies a certification we do not hold.

Custom applications with their own servers need a different conversation. This page covers the website and the shop admin. A product you are building from scratch should include these habits in the web app scope instead of bolting them on as a slogan.

What we actually do

Access first. We list admin users, remove the ones you do not recognise, and turn on the strongest login option the platform offers, such as an authenticator app when the host supports it. Shared "admin / admin" style accounts get replaced. You keep an owner login in your name.

Updates next, on a schedule that matches website maintenance if you want us to stay. Security without updates is a document. Updates without a backup are a gamble. The backup is a copy stored off the same disk as the live site when the host allows it. At the start we restore once to a staging address or a file you can see. A plugin that says "backup enabled" and has never been restored does not count.

We also remove themes and plugins you do not use. Unused code is a common way a WordPress site gets messy. We do not install five overlapping security plugins. One sensible set, named in the quote, is enough. A firewall or host-level option is turned on when your plan includes it. If your plan does not, we say so rather than implying you have protection you are not paying the host for.

Forms and uploads get a look. A public form that accepts any file type is a problem we will flag. We do not promise to review custom code line by line unless that review is the quote.

The order of work

1. Inventory logins, plugins, and the current backup, if any.
2. Fix owner access and remove unknown users.
3. Set the backup and perform one restore test.
4. Update, or schedule updates, and remove unused extensions.
5. Write a one page note: where the backup lives, who can log in, and what to do if the site looks wrong.

If the site is already compromised, we say that clearly. Cleanup of a hacked site is a different urgency and a different quote. We will not quietly "harden" a site that is still serving spam.

Problems and honest limits

We cannot promise you will never be targeted. We can reduce the obvious doors and give you a way back. We do not invent numbers of attacks stopped. If a tool has a log, we can show you the log. If it does not, we do not make up a count.

Host backups that the host will not let you download are weaker than a copy you hold. We will tell you which kind you have. Moving the site to a host with a clearer restore story is website migration, planned so mail and redirects survive.

A redesign does not replace this work. A new theme with the same abandoned admin user is the same risk. If you are rebuilding, pair the launch with this checklist anyway. The public site prices are on pricing. Security setup is additional when it is not already inside a care month.

What you should keep doing

Do not share the owner password in a group chat. Ask us for a separate user if a contractor needs access, and remove it when they finish. Tell us if you add a new plugin. A new plugin is a change to the backup story, and it belongs in the care note.

For a starting point, send the admin URL and say whether you have ever restored a backup. Use contact. If you are unsure whether the site is currently clean, say that in the first message so we do not treat it as a routine setup.