Website security
Website security solutions that keep your site online, clean and in your hands.
Website security for business websites on any platform, including WordPress and WooCommerce, Shopify, Wix, Squarespace and custom-built sites. A firewall in front, malware scanning behind, updates and off-site backups done for you, and someone watching. If your site has already been hacked, we clean it, harden it and tell you plainly what happened.
Since 2021 serving Canadian businesses
Vancouver based, working across Canada
Written quote within one business day
Trusted by
What you get
Everything included in WebCrafters website security.
Security is a set of habits, not one plugin. This is what your monthly plan covers on WordPress and custom-built sites. On Shopify, Wix and Squarespace the platform hosts the site itself, so there the work is accounts, apps, domain settings and monitoring, and your quote says which parts apply.
Malware scanning and removal
The server is scanned every day for malware and injected code. If something is found, we remove it and close the door it came through, rather than sending you a warning.
Firewall and bot protection
A web application firewall sits in front of the site and blocks attacks, bad bots and traffic floods before they reach it, whatever it is built on.
HTTPS on every page
SSL certificates issued and renewed automatically, every page served over HTTPS, and mixed content fixed so browsers never warn your visitors.
Updates done for you
Core, theme, plugin and app updates applied on a schedule and checked afterwards. Out-of-date add-ons are how most small business sites get in trouble, on every platform.
Login hardening
Two-step login, limited attempts, no guessable admin usernames, and admin access only for the people who need it. Old accounts and unused apps are removed.
Daily off-site backups
A copy of the site and its database is kept away from the server every day and test-restored, so a bad day is a rollback, not a rebuild.
Uptime and change monitoring
The site is checked around the clock. If it goes down or a file changes when nothing should have, we know before your customers do.
A monthly report in plain words
What was updated, what was blocked and what we suggest next, on one page you can read in two minutes. Our ticketed support desk is included while the plan is active.
You keep the keys
Your domain, your admin account and your backups stay in your name. Firewall, scanner and backup licences are part of the monthly price, so there is nothing to buy separately or renew on your own.
Not sure how exposed your site is?
Tell Ella what your site runs on and how it is looked after. Ella will tell you where it is exposed and what to fix first.
Six quick questions about your site and how it is looked after today. You get a plain-words plan of the gaps, in the order to close them, and a project lead can turn it into a written quote. Two minutes, no jargon, no obligation.
Ella is automated and can make mistakes. Your written quote from a project lead is the final word.
How it works
From first scan to protected in four steps.
A clean-up and hardening usually takes a few days. Ongoing protection is switched on the same week and carries on month to month.
01
Security check and written quote
We scan the site, the server and the plugins, and read the logs. You get a short report of what we found and a proposal with a fixed price within one business day.
Day 1
02
Clean-up and hardening
Any malware is removed and the way in is closed. Then the basics that should have been there, such as HTTPS everywhere, updates and two-step login, with unused plugins, apps and accounts removed.
Day 2 to 5
03
Firewall, backups and monitoring switched on
The firewall goes in front of the site, daily off-site backups start and are test-restored, and uptime and file-change monitoring begin. You see the first report before the week is out.
Week 1
04
Looked after, month after month
Updates applied and checked, scans and backups running, a monthly report in plain words, and our support desk when you need it. If something does get through, we handle the clean-up and tell you what happened.
Every month after
Under the hood
What the protection actually does, layer by layer.
Most attacks on business websites are automated. Bots look for an out-of-date plugin, a weak password or an open door, and they do not care who you are. The protection is a set of layers that each stop a different kind of attempt, and the numbers below show what that looks like on an illustrative small business site. Yours will differ, and the security audit shows your own.
Three numbers from a month of protection, example site
Requests blocked
Per month at the firewall, before they reach the site
Malware found
Daily scan of every file, nothing to clean this month
Patched in a day
Security releases applied within 24 hours of release
Blocked requests are counted at the firewall, so the site never spends time on them. The scan result is from a daily file scan, and the patch figure counts security releases for WordPress, the theme and plugins applied within a day of publication.
What the firewall stops, by type
Bot and scanner traffic is the bulk of it, probing for known plugin flaws and admin pages. Brute-force logins come next, which is why two-factor login matters more than any single plugin. Exploit probes are the dangerous few, and they are the ones a patched site shrugs off.
Failed login attempts reaching WordPress, before and after hardening, example site
Before hardening, every attempt lands on the login page and the server answers each one. Once the firewall, rate limits and two-factor login are on, most attempts are dropped before they reach WordPress at all, and the few that get through fail at the second step. A fall like this is typical, not guaranteed.
The layers we put in place, and what each one stops
- 01Edge and firewall
- Web application firewall
- Bot and scanner filtering
- Rate limits on floods
- 02Login and access
- Two-factor login
- Limited attempts, no shared passwords
- Admin, hosting and DNS access reviewed
- 03Server
- HTTPS everywhere with HSTS
- Security headers set
- Supported PHP, upgraded in time
- 04WordPress
- Security releases within 24 hours
- Daily malware scan, removal included
- File integrity and plugin flaw checks
- 05Safety net
- Daily off-site backups, tested
- Uptime and change monitoring
- Alerts go to a person
Every request to the site passes through the layers in this order, and each layer is built to stop a different kind of attempt. Scanners and floods never get past the edge, password guessing fails at the login layer, exploits that need an old PHP version or a known plugin flaw find nothing to use, and if something still gets through, the backups and monitoring turn a disaster into a restore. Visitors, customers and Google pass straight through.
If a site is already hacked, the clean-up runs in this order
The order matters. Cleaning files without closing the way in means the site is reinfected within days, which is the most common failure of a cheap clean-up. The report at the end is written for the owner, not for a developer, and it says what to keep doing.
What it costs
A fixed monthly price, agreed before anything is switched on.
We do not publish a single price because a brochure site on our hosting, a Shopify store and a custom-built site on someone else’s server with an active infection are different jobs. What we do promise is a written quote within one business day, and the number does not change unless you change the scope.
What moves the price
What the site is built on, whether it is already infected, how many sites you have, where they are hosted, and whether you want ongoing monthly protection or a one-time clean-up and hardening.
Payment plans up to 24 months
Pay by milestone, or spread the cost over up to 24 months. Credit and debit cards and bank transfer are both fine.
Firewall, scanner and backup licences included
The monthly price covers every security tool and licence the site needs, so there are no add-ons to buy separately. A one-time clean-up without a plan is also available, with a fixed price.
Questions
What owners ask about website security.
If yours is not here, the full list is one click away, or just pick up the phone.
Still have a question?
Call us on a weekday, or send a note and we will get back to you within one business day.
My website has been hacked. What happens now?
If your website has been hacked, call us straight away. We take a copy of the site as it is, find and remove the malware, close the way it got in, and get the site clean again, usually within a few days. If Google or your browser is showing a warning, we request the review once the site is clean. Then we harden it so it does not happen twice.
My website is small. Do I really need website security?
Yes, a small website still needs security, because attacks are automated and do not care how big you are. Bots look for any site with an out-of-date plugin, app or password, and a small business site is often easier to get into than a large one. The cost of a clean-up and the lost trust is almost always more than a year of looking after it properly.
Will website security slow my site down?
No, website security does not slow your site down. The firewall runs in front of the site and the scanning runs on the server, so visitors never wait for either. Sites usually get faster once the bad bots are kept out, because they are no longer serving traffic that was never going to buy anything.
Can you protect a website on Shopify, Wix or Squarespace, or one that someone else built?
Yes, we protect websites on Shopify, Wix, Squarespace and sites built by someone else, on every common platform. A clean-up and hardening can be done on any WordPress or custom-built site wherever it is hosted; for ongoing monthly protection we move those to WebCrafters Cloud, because the firewall, scanning and backups are part of that platform and we can stand behind them. Shopify, Wix and Squarespace host the site themselves, so there we harden the accounts and apps, set up the domain and email records properly, keep a backup of your content, and monitor the site. Your domain stays exactly where it is.
Start today
Tell us about your site. A project lead replies within one business day.
Two minutes to fill in, no obligation. You get a written quote with a fixed price, and it does not change unless the scope does. If your site is down or showing a warning right now, call us rather than filling in the form.
- Written quote within one business day
- One project lead from your first message to launch
- Payment plans of up to 24 months
"*" indicates required fields