Security
Website security hygiene
XCom hardens and maintains sites so routine attacks and stale plugins do less damage. Security here means updates, access control, verified backups, and a plan for the day something looks wrong.
Typical focus areas
- Core, plugin, theme, and dependency update discipline
- Admin access review and least privilege
- Removing abandoned plugins and unused accounts
- Malware cleanup and reinfection prevention
- Backup verification, not just backup existence
- TLS, security headers, and login hardening
How small business sites actually get compromised
Almost never through a targeted attack. The realistic threat is automated: bots scanning the entire internet for a known vulnerability in an outdated plugin, then exploiting it at scale. Nobody chose your business specifically.
That is good news, because it means ordinary maintenance stops the overwhelming majority of it. An abandoned plugin that has not been updated in three years is a far bigger risk than the absence of any advanced security product.
If your site is already compromised
Cleaning the visible symptom is not the same as fixing the breach. If the entry point stays open, the site gets reinfected within days and you end up paying twice.
The order matters: contain it, find how they got in, clean thoroughly, close the hole, then rotate every credential that could have been exposed. Restoring a backup from before the infection sounds appealing but reintroduces the same vulnerability unless it is patched at the same time.
Ongoing maintenance versus one-time fixes
Security is not a project you complete. A site that was hardened last year and left alone is running last year's vulnerable plugin versions today.
Ongoing maintenance covers the update cycle, watches for the plugins that get abandoned by their authors, and keeps a restore path that has actually been tested. If you prefer to handle that internally, we will document what needs doing so it is a real handoff rather than a guess.
Common questions
- Our site got hacked. Can you clean it?
- Yes. Cleanup is only half the job though. We also find and close the entry point, then rotate credentials, because cleaning the symptom alone usually leads to reinfection within days.
- Is a security plugin enough on its own?
- No. Plugins help, but the common cause of compromise is an outdated or abandoned component. Update discipline does more for you than any single product.
- Why would anyone target a small local business?
- They generally are not. The attacks are automated scans looking for known vulnerabilities across the whole internet, which is exactly why routine maintenance is so effective.