Website security hardening
Your website locked down: updates, logins, permissions, firewall and backups checked and fixed.
GradaxEuropean companyOrder outright
Founded 2014·Built and operated in Europe·3 days to 2 weeks
About this service
Most hacked small-business sites are broken into through an outdated plugin, a reused password or an admin account nobody remembers creating. We audit the site and its hosting, close those doors, add a firewall and monitoring, and leave you with a short list of habits that keep it closed.
How small websites actually get hacked
Almost nobody targets your website personally. Automated tools scan millions of sites for known weaknesses and break into whichever ones have them. The most common entry points are outdated plugins with published vulnerabilities, weak or reused admin passwords, and old admin accounts nobody remembers.
That is good news, because it means most attacks can be stopped by closing a small number of doors. Updating and removing unused software, enforcing two-factor login, limiting login attempts and adding a firewall stops the bulk of automated attacks. It is not glamorous work, and it is what actually matters.
A backup that has never been restored is a hope
Most sites have some kind of backup. Far fewer have one that works. Backups stored on the same server disappear when the server is compromised. Backup plugins fail silently for months. Database exports are missing the uploads folder, so the restored site has no images.
We set up backups stored somewhere separate from the website, then restore one to a test location to prove it works. You get written instructions for doing it again, so a restore at a bad moment does not depend on us.
We also look at the hosting. Shared servers with outdated PHP versions, file permissions that let anyone write to the site, and admin panels exposed to the whole internet are common, and fixing them often takes minutes once they are found.
- Outdated and abandoned plugins updated or removed
- Two-factor login for every administrator
- Firewall and login rate limiting active
- Backups stored off-site and restore-tested
- Security headers and file permissions corrected
What you get
Everything below is in the price. Nothing here is an upgrade.
- Security audit report with findings ranked by risk
- Fixes applied, each logged
- Firewall and malware scanning configured
- Backup schedule with a tested restore
- Security checklist for your team
What changes
- Core, theme and plugins updated, with abandoned plugins removed
- Two-factor login for every admin, and unused accounts deleted
- A web application firewall and login rate limiting active
- Security headers and HTTPS configured correctly across the site
- Off-site backups tested by an actual restore
How it runs
Audit
Software versions, users, permissions, server settings and exposed files.
Back up
A full backup taken and stored off-site before anything changes.
Harden
Fixes applied in order of risk, each one tested.
Monitor
Firewall, scanning and uptime alerts switched on and pointed at you.
Compare the sizes
The standard price for each size. Extras are priced beside it, not hidden behind a call.
| Included | Essential hardening€2903 to 5 working days | Site and server€5001 to 2 weeks | Hardening and monitoring€1,0502 weeks, then 3 months of monitoring |
|---|---|---|---|
| Security audit | Included | Included | Included |
| Updates and plugin cleanup | Included | Included | Included |
| Two-factor login and user review | Included | Included | Included |
| Firewall setup | Included | Included | Included |
| Backup with test restore | Included | Included | Included |
| Server and hosting configuration review | Not included | Included | Included |
| Security headers and TLS settings | Not included | Included | Included |
| File permission and database user fixes | Not included | Included | Included |
| Vulnerability scan with written results | Not included | Not included | Included |
| Uptime and file-change monitoring | Not included | Not included | Included |
| Monthly updates and checks for three months | Not included | Not included | Included |
| Order | Select | Select | Select |
Add what you need
Choose the size
Add what you need
Your total€500
ContinueThe standard price, plus whatever you add. Confirmed in writing before anything starts; nothing is charged until you accept it.
Questions
Our site is already hacked. Is this the right offer?
Not first. Cleaning an infected site is website malware removal; hardening comes straight after, so it does not happen again.
Which platforms do you cover?
WordPress most often, plus WooCommerce, Joomla, Drupal, PrestaShop and custom PHP sites. Hosted builders like Shopify and Wix handle most server security themselves.
Is this a penetration test?
No. It is a hardening job for a business website. Formal penetration testing, for compliance or a large application, is a separate specialist engagement.
Related searches
Related work
One-timeWebsite malware removalA hacked website cleaned, the way in found and closed, and search engine warnings removed.from €290one-time
One-timeWebsite backup and migrationYour site moved to new hosting without downtime, with backups that have been tested.from €290one-time
One-timeWebsite bug fixesBroken forms, layout glitches, errors and plugin conflicts found and fixed, with the cause explained.from €290one-time
Order it
Standardised enough to order on its own. The price is confirmed in writing before anything starts.