Website security: audit, hardening and help when you've been hacked
We find the ways someone could get into your website, close them and put bot protection in front. If you're breached, we clean the site up and work out how it happened.
- Area
- DevOps & hosting
- Timeline
- 3–7 working days
- Industries
- All industries, Online shops, Clinics and practices
- Free quote within 24 h
- Fixed price once quoted
- Free concept before you sign
- Project code is yours once paid for
- Written contract and VAT invoice
- A team with over 10 years of experience
Website security
Who it’s for
Owners of websites that have quietly accumulated plugins, user accounts and forgotten copies over the years. Especially shops handling customer data and payments, clinics whose forms ask patients about symptoms, and businesses that have been hacked once and would rather not repeat the experience.
Most attacks on small business sites aren’t personal. Bots sweep the web for known holes in popular plugins and for weak passwords. That’s why simple, consistent protection goes a long way.
What we do
We start with an audit. We check the versions of your CMS, theme and plugins, including extensions their authors have abandoned. We review user accounts and roles, file permissions, server and TLS configuration, security headers, and whether admin panels are exposed to the whole internet. Our checklist draws on the OWASP Top 10, among other sources. You get a prioritised report: urgent, important, can wait.
Then we harden the site. We remove unused plugins and accounts, turn on two-factor authentication for administrators, limit login attempts and apply least privilege throughout. We put a web application firewall and bot protection in front, and protect forms from spam without tracking your visitors.
We keep an eye on security patches. When a serious vulnerability appears in a plugin you use, we update it as a priority, after a backup and a test on staging.
If there’s an incident, we cut off access, keep a copy of the infected version for analysis, clean the files and database or restore a clean backup, and rotate passwords and keys. Afterwards you get a report: how they got in, what they changed and what we’ve done to stop it happening again.
How we work
- A quote for the audit and hardening within 24 hours. Live incidents go to the front of the queue.
- Audit and prioritised report.
- Hardening once you approve it, on a copy first, then on the live site.
- Optional ongoing protection: patching, log reviews and a periodic re-audit.
An audit with hardening typically takes 3–7 working days. A hack clean-up depends on how deep the infection goes and the state of your backups.
What we need from you
- Administrator access to the site and the hosting.
- A list of people and companies who have, or had, admin accounts.
- Details of integrations and API keys the site uses.
- Your data protection officer’s contact details, if you have one.
Technology and integrations
We work with content management systems, the major shop platforms and applications on self-managed servers, using a web application firewall (WAF) with bot management, security plugins and vulnerability scanners. Keys for Stripe, your CRM or your booking system are kept out of the site’s code, with permissions cut to the minimum each integration needs.
What we don’t do
- We don’t guarantee your site can’t be hacked. Nobody honestly can. We reduce the risk and shorten the time to recover.
- We don’t issue security certificates or run compliance audits against standards.
- We don’t test systems you don’t have the rights to.
- We don’t negotiate with attackers or pay ransoms.
- We don’t give legal advice on data breaches.
Free quote within 24 hours
Send us the site address, what it’s built on and whether you’ve had an incident before. If the site is infected right now, say so in the first line of your message. You’ll have a quote for the audit and hardening within 24 hours.
- OWASP Top 10 · accessed 11 October 2026
- GDPR, Article 33 — notification of a personal data breach (EUR-Lex) · accessed 11 October 2026
Other services in area 04
Questions we hear most often
Can't find your question? Write or call — we'll give you a straight answer, no strings attached.
[email protected]+48 889 009 55001Our site has been hacked. What should we do first?
Don't start deleting files or restore an old backup straight away: you may wipe the evidence of how they got in. Change your hosting control panel password and send us the site address. We'll start by freezing the current state and keeping a copy of the infected version for analysis.
02Isn't a free security plugin enough?
It's a useful layer, but it doesn't replace housekeeping. A plugin won't remove an abandoned extension with a known hole, close old admin accounts or configure your server. We often install one as part of the set-up.
03Do you carry out penetration tests?
We audit configuration and the vulnerabilities typical of websites and shops. We don't issue formal penetration test reports or certificates. If a client or insurer requires one, we'll recommend a specialist firm and prepare the environment for them.
04Do we have to report a breach to the regulator?
It depends on whether personal data was exposed and how risky that is for the people affected. Under the EU GDPR and the UK GDPR, a breach that poses a risk must generally be reported within 72 hours of becoming aware of it. You decide as the controller, ideally with your data protection officer or solicitor. We provide the technical facts: what happened, when and how.
Promises we can actually keep.
The same rules on every project — from the first call to support after launch.
- Free quote within 24 hYou get the quote within 24 hours of your enquiry — including weekends and public holidays.
- Fixed price once quotedThe quoted amount does not grow unless you change the scope.
- Free concept before you signA mockup of 1–2 screens or a chatbot script with sample answers.
- Payment in stagesWe pick the payment plan that suits the project.
- 30 days of free fixesCounted from the day the project goes live.
- Code, domain and loginsProject code is yours once paid for, and our libraries come with source code, for good. Domain and accounts are in your name from day one.
- Contract and VAT invoiceWe work under a written contract and invoice every payment.
- Want it in writing?Every one of these terms is in the quote and the contract.Free quote within 24 h
Tell us about your project. Free quote within 24 h.
A few sentences are enough. Within 24 hours of your enquiry — including weekends and public holidays — you get a quote with the scope and a fixed price.
- [email protected]
- Phone
- +48 889 009 550
- Quote
- within 24 hoursof your enquiry, incl. weekends and public holidays
- Languages
- English, Polish, Ukrainian, RussianGerman in writing
Thank you, we’ve received your enquiry.
You’ll get your quote within 24 hours, including weekends and public holidays.