Reducing the attack surface before multiplying security tools
Security often starts with ordinary decisions: maintained dependencies, minimal permissions, secrets kept out of the repository, input validation, backups, HTTPS and protected admin access.
Reply within 24 business hours · free 30-minute discovery call · free detailed quote
Preparing for the consequences of an incident
We also look at the consequences of an incident. Does a backup really exist? Can it be restored? Will the logs make it possible to understand what happened?
Reducing risk, preparing the response
Security is never absolute. The job is to reduce risk and prepare the response.
Ordinary protections, layered
Most intrusions we see exploit an outdated plugin, a reused password or a poorly validated form, not a sophisticated vulnerability. Effective protection therefore starts with habits: update, limit permissions, validate what comes in and be able to restore.
What a security audit checks
- admin accounts, passwords and two-factor authentication;
- versions of the CMS, plugins, PHP and libraries;
- validation of forms, file uploads and APIs;
- secrets (keys, passwords) kept out of the code and the repository;
- HTTP security headers and HTTPS configuration;
- the existence of backups and a real restore test.
After an intrusion
- Isolate the site and keep a copy of its state for analysis.
- Identify the entry point: without it, reinfection is likely.
- Clean up or rebuild from a trusted source, then change all access credentials.
- Fix the vulnerability and monitor over the following weeks.
- Deal with the consequences in Google: security warnings, unwanted pages to remove from the index.
Hacked sites are often used to publish spam pages; we make them disappear cleanly with “410” responses rather than leaving them as errors.
Frequently asked questions
Is WordPress less secure?
The WordPress core is well maintained; the risk comes mainly from numerous or abandoned plugins. A WordPress site with few plugins, kept up to date and backed up, is reasonably secure.
Do we need a web application firewall?
It can filter some automated attacks, but it replaces neither updates nor backups. We see it as an extra layer, not the foundation.
Our security packages
Security audit
on quotation
To find your weaknesses before an attacker does.
- accounts, passwords and two-factor authentication
- versions and plugins
- forms, file uploads and APIs
- backups and restore test
Post-hack clean-up
on quotation
To restore a hacked website and prevent reinfection.
- isolation and copy for analysis
- search for the entry point
- clean-up or rebuild, change of all credentials
- removal of unwanted pages from Google
Ongoing protection
on quotation
To stay protected over time.
- monitored updates
- verified off-server backups
- monitoring of files and errors
- response within 4 business hours in case of a hack
Website hacked right now? Write to us describing the symptoms: we reply within 24 business hours, and within 4 business hours if you have a contract.
Our commitments
- Reply within 24 business hours to every enquiry.
- Free 30-minute discovery call, followed by a free detailed quote valid for 30 days.
- A single point of contact: the developer who builds your project, self-employed since 1999.
- You own the code, the access credentials and the content once the project is paid for.
- 3-month warranty: defects reported after launch are fixed free of charge (terms).
- Staged payments available: 30% deposit on order, then a payment schedule suited to the project.
- Response within 4 business hours in case of an outage or hack, for clients on a maintenance contract.
- Projects run in English or French, for businesses in France and abroad.
Review your security
Let’s start with access, dependencies and your real ability to restore.
What happens next?
- You describe your project in a few lines.
- We reply within 24 business hours to schedule a free 30-minute call.
- You receive a detailed quote: scope, price, schedule and payment plan.
Prefer to call? +33 7 66 06 80 03