Most sites are not attacked on purpose. They are found by a script.
Nobody chose your business. Automated tools scan the whole internet for known weaknesses - an out-of-date plugin, an unprotected login, a server nobody has patched - and try them all.
Which means security is not about being important enough to target. It is about not being the easiest door on the street.
Clutch 5.0/5 · 15+ years experience · Australia-wide
The cost is rarely the clean-up.
A compromised site damages the thing you spent years building.
Search engines flag hacked sites and browsers warn people away from them. Rankings you paid for over months can be gone in a day, and getting the warning removed takes longer than getting infected did.
If the site takes payments or holds customer details, the problem stops being about your website and becomes about your customers.
Almost every breach we see was preventable, and boring.
Not a clever exploit - an old plugin, a password reused from somewhere else, a login page anyone on the internet could reach and guess at.
That is genuinely good news. It means the work is unglamorous and mostly finite, rather than an arms race you cannot win.
Where sites actually get in trouble.
In roughly the order the problems turn up. Most sites have several of these open at once and no idea which.
The hosting underneath
Some platforms ship with sensible protection and some leave it entirely to you. Knowing which you are on decides everything after it.
The software on top
WordPress, Drupal, Joomla or a custom build all fail differently. Version, plugins and themes are where known weaknesses live.
Login hardening
Password rules, limits on repeated attempts, and not leaving an admin page reachable by anyone who guesses the URL.
A firewall in front
A web application firewall filters malicious requests before they reach your site. Worth it on anything holding data or taking payments.
Backups you have tested
An untested backup is a belief, not a safeguard. The question is not whether it runs but whether you have ever successfully restored from it.
Staying current
Security is not a project that finishes. Servers and software need updating as weaknesses are published, which is continuously.
Find the open doors, then close them.
We start by looking rather than by selling you a plan, because until somebody checks, nobody knows which of these applies to you.
Review the hosting and the build
Step 1What your site runs on, what it is built with, and which versions. This is where most of the surprises are, and it costs nothing to look.
Harden what is exposed
Step 2Logins, forms, database access and admin pages. The unglamorous work that removes the weaknesses scripts actually try.
Add a firewall and working backups
Step 3Filtering in front of the site, and a backup we have restored from at least once so you know it works before you need it.
Keep it patched
OngoingUpdates applied as they are published, with an eye on whether an update breaks anything. Both halves matter - an unpatched site and a broken site are both offline.
What businesses ask about website security.
We are a small business. Would anyone bother attacking us?
Nobody chose you. The scanning is automated and indiscriminate - it looks for a known weakness, not for a business worth robbing. Small sites get compromised constantly, usually to send spam or host something else, and the owner finds out when a customer or Google tells them.
Our host says security is included. Is that enough?
Sometimes, for the server. It rarely covers what you installed on top - plugins, themes, weak passwords, an exposed login page - and that is where most compromises happen.
The audit tells you exactly which half you are covered for.
Can you guarantee we will not be hacked?
No. Anybody who does is selling something. What we can do is close the weaknesses that are actually being exploited, make sure a backup will bring you back quickly, and keep the software current - which is what separates an inconvenience from a disaster.
Something has already happened. Can you help?
Yes, and tell us early. Cleaning a compromised site is a different job to securing a healthy one: it means removing what was left behind, working out how they got in, and closing that before restoring - otherwise it happens again within days.
Find out which doors are open.
Send us the site. We will look at the hosting, the build and what is exposed, and tell you what needs doing in order of how much it matters.