How to recognize the problem
Security hardening is about reducing the chance and impact of compromise, not promising an invulnerable website.
- No one knows if backups can actually be restored.
- Unnecessary administrative accounts or unused extensions remain.
- Updates have been postponed because the site is fragile.
- A previous hack was cleaned without reviewing the entry path.
What gets investigated
Specific steps depend on the website and available access. A typical review can include:
- Review core components, extensions and support status.
- Identify excess privileges and unnecessary attack surface.
- Check backup and recovery arrangements and prioritize practical changes.
- Document what was improved and what still requires attention.
What a responsible fix looks like
An actionable security baseline that can be maintained by the current team or through an optional care agreement.
Boundary: No WAF, plugin or hardening checklist eliminates all risk. Hosting and application security need continuing attention.
What to send with your request
Start with the website URL, what visitors see, when it began and any recent changes. A list of existing backup and security tools is helpful if available.
Do not include passwords, database dumps, customer information or payment data in the initial request.
Useful reading
Talk through this problem
The initial scope enquiry is free. Any paid assessment or repair is quoted separately after reviewing the information available.
Describe this issue ↗