Security you can verify, not just believe.
Most small business sites are not attacked by someone who chose them. They are found by a script, through a plugin nobody updated. We close those doors, keep them closed, and prove the backups work.
What we keep closed
Updates, on a schedule
WordPress, plugins, themes, libraries and server packages updated on a regular rhythm, tested before they go live, not left for the day something breaks.
Backups we restore
Daily backups kept off the server, and a restore tested in front of you. A backup nobody has restored is a hope, not a backup.
Cloudflare in front
A firewall ahead of your site: known attacks blocked, bad bots filtered, login and form pages rate limited, traffic surges absorbed.
HTTPS and headers
Certificates that renew on their own, strict transport security, a content security policy, and the headers that stop your pages being framed or sniffed.
Access you can audit
Two-factor on every admin account, old accounts removed, one account per person, and least privilege rather than everyone an administrator.
Monitoring and alerts
Uptime, certificate expiry, file changes and suspicious logins watched, with an alert that reaches a person rather than a dashboard nobody opens.
When something is already wrong
Malware cleanup
An infected site cleaned, the entry point found and closed, and the search engine warnings lifted once Google rechecks it.
Hacked site recovery
Defacements, spam injections and redirect hijacks: the site restored from a clean backup, and the hole closed before it goes back up.
First response
If something is happening right now, we take the immediate steps: take the site out of harm's way, preserve the logs, and stop the bleeding.
Escalation
When an incident is beyond a website, it goes to the security specialists we work with, and you are told that plainly rather than left waiting.
With a specialist
- Penetration testing, carried out by a security specialist based in Canada
- Vulnerability assessment of an application before it goes live
- Security review of an architecture, an API or a cloud setup
- Incident response when a breach is already underway
- Every test starts with your written authorisation, naming the systems and the dates
Who this is for
- Businesses running WordPress with plugins that have not been updated in months
- Online stores holding customer orders and addresses, where downtime costs sales
- Practices and firms holding client information they are legally responsible for
- Anyone who has just been hacked, redirected or blocklisted by Google
- Companies whose own client asked them a security question they could not answer
Questions, answered
Can you guarantee we will not be hacked?
No, and nobody honest can. Security work reduces risk and shortens recovery; it does not remove the possibility. What we can promise is that the known doors are closed, the software is current, the backups restore, and you hear about a problem from us rather than from a customer.
Do you test systems without permission?
Never. Scanning or testing a system without the owner's written permission is a criminal offence in Morocco, France, Canada and the United States, whatever the client said on a call. Any testing starts with a signed authorisation naming the exact domains, addresses and dates.
Our site is infected right now. What happens?
Tell us today. We take the site out of harm's way, keep the logs, clean it or restore a clean backup, find and close the entry point, then ask Google to recheck it. We quote the cleanup after a first look, because the work depends on how deep the infection goes.
Who does the specialist work?
Testing, architecture review and live incident response are carried out with security specialists we work with, based in Canada. We stay accountable for the engagement, and we say up front which part is ours and which part is theirs.
Can you certify us ISO 27001 or SOC 2?
No. Those certifications are issued by accredited auditors, not by a studio. We can prepare the technical side and work alongside your auditor, but anyone offering you the certificate itself is not telling you the truth.
Is this the same as the website audit?
The audit is a one-off report on performance, SEO, accessibility and security. This is the ongoing work that keeps a site safe month after month, plus the help when something has already gone wrong.
Not sure what is exposed?
Send us the address of your site. We will look at what is public, tell you plainly what we found, and what it would take to close it.