Website Security Without All the Technical Headaches
Website security involves a lot more than most business owners ever see. In fact, if your website hosting and security are being managed properly, there are probably quite a few things happening behind the scenes that you never hear about.
That is part of the point.
On Security Essentials hosting plan, Full Scope Creative handles the basic monitoring, WordPress updates, security notices, and basic steps to help keep a website stable and protected.
There are emails at 2:00 in the morning that a brute-force attempt is happening to the website. You probably won’t get that email. We get that email.
More importantly, we know what that email means and whether anything actually needs to be done about it.
Security Essentials handles the everyday security and maintenance your website needs. If you want active malware scanning, firewall protection, and malware cleanup included too, take a look at our Security Max hosting plan.
What Does Full Scope Creative Monitor?
There are constantly bots, spammers, scripts, and hackers looking for ways into websites. That doesn’t mean every security notice is an emergency.
For the websites we design and host, Full Scope Creative receives the security notices generated by the website and its security systems. Security Essentials sites use All In One WP Security as part of their basic WordPress security setup.
We can receive notices about things such as:
- Brute-force login attempts
- Failed login attempts
- Password reset attempts
- Suspicious logins
- Attempts to log in with usernames that don’t exist
- Password changes
- Other unusual activity around the WordPress login
We also manage the WordPress system, plugin, and theme updates for the website.
One advantage of having us receive these notices is that you don’t have to figure out what every security email means.
Some alerts need action. Some don’t.
If you’ve never dealt with website security before, an email saying someone tried to attack your website can sound pretty scary. We see these types of notices regularly and can determine whether something actually needs our attention.
What Happens When We Receive a Security Alert?
The first thing we do is figure out what happened.
We don’t automatically forward a technical security notice to a client and leave them wondering what they’re supposed to do with it.
We review the alert and determine whether action is needed.
That could mean blocking an IP address. It could mean blocking traffic from a particular country. It could mean looking at what happened to determine if malware may have got into the website.
The answer is sometimes that nothing needs to be done.
A brute-force attack may attempt to get into the website. The security in place (that we manage) can block those attempts, leading to the script or bot eventually moving on.
In those cases, there isn’t any value in sending the business owner an email and asking them to learn what a brute-force attack is. There’s no need for them to determine whether the attack was successful or what to do next.
That’s our job.
When Do We Block an IP Address or Country?
Blocking traffic is another way we can add protection to a website.
If the same IP address is repeatedly attempting to access a website or running a brute-force attack, we can block that IP address.
The basic security settings also block an IP address if someone repeatedly uses a username that doesn’t exist on the website.
Blocking one IP address isn’t a perfect solution. Spammers and hackers can change their IP address and throw that off. But it is a small layer of protection that can make it harder for an attack to continue.
We also block countries when it makes sense.
Almost every website we host has at least a few countries blocked. If a business only operates in Wisconsin or throughout the United States, there may be very little reason for its WordPress login to be receiving repeated attempts from certain parts of the world.
We may also add blocks when we see a large amount of spam or malicious activity coming from a particular country.
For example, we once received a notice showing a client’s account logging in from Russia. We knew the client wasn’t in Russia. That told us very quickly that something wasn’t right, and we were able to block that traffic.
Why You Usually Won’t Hear About Every Security Event
One of the benefits of managed website hosting is that you don’t have to become your own website security department.
There are security events happening on websites all the time.
Most business owners don’t need another inbox full of notices telling them that a bot attempted to log into WordPress or that an IP address was blocked.
We receive those notices. We review them. If action needs to be taken, we take the steps available through the Security Essentials plan.
If something happens that requires your attention, we’ll reach out and have that conversation.
The majority of this work stays behind the curtain.
You have your own business to run. You shouldn’t have to stop what you’re doing every time a bot decides to knock on the door of your website.
Keeping WordPress Updated Is Part of Website Security
Keeping WordPress updated is one of the most important steps to maintaining a secure WordPress website.
One of WordPress’s biggest advantages is the number of plugins and themes available. They allow for added functionality, without having to create everything from scratch.
That flexibility and power also creates security vulnerabilities if those plugins, themes, and core systems aren’t kept updated.
Security fixes are regularly included in WordPress, plugin, and theme updates. Leaving old software running on a website can leave an opening that an attacker may be able to use.
As part of Security Essentials hosting, Full Scope Creative handles those updates for you.
We normally run WordPress, plugin, and theme updates weekly. When WordPress releases a core system update, we may run updates more frequently because plugin and theme developers often release their own updates in response.
You don’t need to know which plugins need to be updated. There’s no need to wonder whether your WordPress installation is six months behind.
We take care of it.
What Security Essentials Does Not Include
Security Essentials is designed to provide the basic security a professionally hosted business website should have.
There is one important distinction, though.
Security Essentials does not include an active cPGuard malware scanner, firewall, or malware cleanup.
We do what we can through the basic security settings to prevent an infection from getting into the website in the first place. But Security Essentials does not have a system continuously scanning the website for malware and cleaning infected files.
It would be like running a computer without dedicated antivirus software. You can still take precautions. You can keep the software all updated, use strong passwords, avoid suspicious files, and put other security measures in place.
What you don’t have is the additional layer of software actively scanning for an infection.
That additional layer is what our Security Max hosting plan provides through cPGuard.
Malware cleanup can also be far more complicated than simply finding one bad file and deleting it. An infected website may have dozens or even hundreds of malicious files buried throughout its folders. Some malware is designed so that removing one infected file can cause additional files to be recreated elsewhere.
If malware does make its way onto a Security Essentials website, we’ll contact you and explain what we’ve found. We can then add cPGuard and clean the website, but there is an additional cost for that service. Moving to Security Max gives the website the ongoing cPGuard license as part of the hosting plan.
Security Essentials Gives Your Website a Strong Foundation
No hosting company can truthfully promise that a website will never be attacked or infected.
Security Essentials isn’t intended to make that promise.
It’s designed to give a small business website the basic security, maintenance, and monitoring it should have. We keep WordPress updated, receive and review security notices, block suspicious activity when appropriate, and handle many of the routine security events that you shouldn’t have to worry about.
For many small business websites, that provides a solid foundation and a much better alternative than simply putting a WordPress website online and hoping nothing happens.
For businesses that want the additional protection of active malware scanning, a firewall, and malware cleanup, the next step is our Security Max hosting plan.