Website security and safety first – be a happy website owner

Yet another website security email this morning warning of a site vulnerability and having to defend sites against traffic floods prompted me to highlight the increased activity around software and website security.

Your website probably isn’t being targeted by a hacker anymore. It’s being targeted by automated software.

The tools used to attack websites are becoming faster, cheaper and increasingly automated. AI is making it easier to discover weaknesses and exploit them on an industrialised production line basis.

For example Apple’s latest iOS update (July 2026) included around 90 security fixes, far more than than normal. The tools designed to break into software like websites and operating systems are getting better every day.

I’m seeing security alerts daily compared to a historic average of one a month – a 30 times increase in frequency. We don’t used bad plugins, it’s just that the tools to find security gaps have become so much better.

If your business relies on a custom WordPress website, it’s worth asking a simple question:

Who’s watching your website security while you’re getting on with running your business?

Wesbite security isn’t something you install once and forget. It works best as a series of overlapping layers, each designed to catch what another might miss.

Our approach typically includes:

🛡️ Protection inside WordPress

Security software such as Wordfence monitors for malware, vulnerable plugins, unexpected file changes and suspicious login attempts.

🌐 Protection before traffic reaches your website

Cloudflare sits in front of a site, filtering malicious traffic, blocking known attackers and absorbing automated attacks before they ever reach your server.

Cloudflare also has the means to block traffic floods which can knock your site out. I’ve seen these happen regularly where the amount of traffic being received can be 5 to 10 times normal, something which many web servers aren’t ready to handle.

👀 Independent daily monitoring

We use a site monitoring and maintenance service WP Umbrella to continually detect and report security issues, that the website is online and the site is stable. This service also provides the business owner with a dashboard report on site visitors, security issues and site performance, providing confidence.

💳 Independent external security testing for eCommerce sites

For eCommerce websites, we recommend regular external vulnerability scanning for PCI / DSS compliance testing by an accredited provider, giving you independent reassurance that your site is meeting recognised security standards.

Why all this?

Because I’ve seen the alternative.

I once helped recover an online shop that had been quietly recording customers’ payment card details. The owner had no idea anything was wrong until the compromise was discovered. By the time the investigation, remediation and card scheme penalties had been dealt with, the cost was around £50,000.

Another example was a site taken over by advertising, as the site password was the same as the business name! We took over that one and used better passwords and two-factor authentication to block unwanted access.

A well-maintained, professionally monitored website is far more likely to detect problems early, reduce the attack options and prevent a minor issue becoming a major incident.

If you have a WordPress website, ask your maintenance provider one question this week:

“How are you monitoring my website security today?”

If the answer is simply “we install updates”, it may be time to ask a few more questions.

If you want a better answer or some (free) advice, just get in touch.