Most WordPress compromises are not targeted. They are automated traffic trying known weaknesses against every site it can reach, which means the defence is mostly about not having those weaknesses.
The picture people have is of somebody choosing their site and attacking it. The reality is scripts working through enormous lists of addresses, trying a handful of known plugin vulnerabilities and a dictionary of passwords. Your site is not picked; it is simply reachable.
That is good news, because it means the effective defences are unglamorous. Patch promptly, keep the attack surface small, put filtering in front so the automated noise never reaches the application, and make sure one compromised site cannot reach another.
A security plugin helps but acts late — it runs once the request has already reached WordPress and started executing code. Stopping that traffic earlier is both cheaper and more effective.
What we do
Working UK-wide and internationally — directly with businesses, and white label behind design and marketing agencies.
Discuss a projectKnown-bad requests and probes refused before they cost you anything. The bulk of automated traffic never gets further than this.
Requests inspected ahead of WordPress starting, so a vulnerable plugin is never reached by the thing trying to exploit it.
Per-visitor limits with escalating blocks for repeat offenders, which is what stops password guessing being worth anybody's time.
Each site with its own system user and processes. One compromised site on the platform cannot read or reach another.
Core, plugins and themes updated in windows and checked, rather than when something forces the issue.
Malware scanning on the files, so a compromise is found by us rather than by a customer or by Google.
Nobody can promise a site will not be compromised. What these layers do is remove the easy routes, which is what almost all automated attacks rely on.
A shared admin password, or an old account belonging to somebody who left, defeats most of this. Access control is as important as anything technical.
The fewer you run, the smaller the surface. Reducing an overgrown plugin list is often the single most useful security work available.
A lot of our work is delivered white label or under agreement, so these describe the problem and the approach rather than naming the client.
Ten brand websites across one instruments group. Several we built, the rest we inherited — and all ten are hosted, maintained and supported by the same team.
Portal · Ecommerce · MigrationAn industrial-scale ordering portal migrated off a legacy platform, with client authentication, advanced search and form-to-CRM integration.
Managed website backups held off-site, with the job verified as having run and the restore actually tested. What most backup services never check.
Monitoring that checks real pages rather than just the home page, and alerts the people who can fix it rather than only telling you.
Ongoing support and maintenance for WooCommerce shops: checkout kept working, updates tested before they go live, and someone who can read the code.
Versions, accounts, what is exposed and whether the backups work. That tells you where you actually stand, and it is yours to act on with us or anybody else.