Website security for Des Moines businesses
Prevention rather than panic: fewer moving parts, least privilege, current software and backups that have actually been restored. Configured before the site goes live.
Since 2011 · Prevention-first · Honest about response times · Veteran-owned
How small business websites actually get compromised
Almost never the way people picture it. There is no one at a keyboard choosing you.
Bots crawl the web reading which plugin versions a site runs and matching them against published vulnerability lists. Nothing about it is personal. Being small is not protection — it is what makes you cheap to try.
Every plugin is somebody else’s code running on your site with your permissions. Half of them were installed for something that got abandoned. Each one is a door, whether or not anyone walks through it.
One password, known by four people, two of whom have left. No way to tell who changed anything, and one leaked password is total access rather than partial.
Default settings, file editing enabled in the admin, version numbers advertised, no rate limiting on the login. None of it is exotic to fix. Almost nobody does it at build time.
WordPress hardening, updates and vulnerability scanning
Unglamorous, specific, and it prevents most of what actually happens.
- The smallest plugin set the site actually needs, with everything unused removed
- One account per person, at the lowest permission level that lets them do their job
- Administrator access rate-limited and protected with two-factor authentication
- File editing disabled in the admin, so a stolen login cannot become running code
- Version numbers and directory listings no longer advertised to a scanner
- Core, theme and plugin updates applied promptly rather than in an annual batch
- Vulnerability monitoring against published advisories for what you actually run
- Login and change monitoring, so an unexpected admin account is noticed
- A written record of what was hardened, so you can hand it to anyone who asks
Security configured before your site goes live
The cheapest security work available, and the least often done.
Most security spending happens after something has gone wrong, which is the most expensive moment to start. Nearly everything that matters is a configuration decision made while the site is being built and it costs nothing extra to get right then.
So on every site we build: the plugin count stays as low as the job allows, accounts are created per person at the lowest useful permission level, the admin is rate-limited and behind two-factor, file editing is switched off, and the site stops advertising what versions it runs. That is not a product and we do not sell it separately — it is what building a site properly means.
Prevention is also why we argue about plugins. Every one you add is code you did not write running with your permissions, plus a vendor who might lose interest. The most effective security measure available to a small site is having fewer things installed on it.
Monitoring and what happens when something does go wrong
Prevention is most of it. It is not all of it.
Monitoring is watching for the specific things that indicate trouble: the site going down, an administrator account appearing that nobody created, files changing when nobody deployed anything, or a published advisory landing for something you run. Each of those has a response, and the response is written down before it is needed rather than improvised at the time.
If something does happen, the sequence is: take the site off the public internet so it stops doing harm, work out how they got in, rebuild from a clean backup rather than trying to pick malware out of a live site, close the route, then rotate every credential. Cleaning without finding the entry point just means it happens again next week.
Restoring depends entirely on having a backup that works, which is why we test restores rather than trusting that the backup job reports success. A backup nobody has ever restored is a belief.
If your website is hacked right now
Read this part before you read anything else on the page.
If you need someone within the hour, we are not the right call. We are a small team, we do not run a 24-hour incident desk, and there are specialist emergency response firms who will pick up immediately and charge accordingly. If your site is taking money and it is down, use one of them and do not wait on us to reply to an email. We would rather say that than have you lose a day being polite.
Two things worth doing yourself in the meantime, both free: take the site offline or put it into maintenance mode so it stops serving anything harmful to your visitors, and change the hosting and admin passwords from a device that is not the one you normally use. Neither fixes it. Both stop it getting worse.
If it is not an emergency — a site that is already down, a suspicion, a warning from Google, or a clean-up somebody else did that you want checked — that is work we will take on and quote before starting.
What our website security does not include
Stated plainly, because security is the easiest service to oversell.
- A guaranteed emergency response time — we do not run a 24-hour desk and will not pretend to
- Any promise that a site cannot be compromised. Nobody can honestly make that one
- Penetration testing or formal security certification
- Compliance auditing — HIPAA, PCI, SOC 2 and the rest need a qualified assessor, not us
- Network, device, endpoint or email security — this is the website only
- Recovering data that was never backed up
- Legal or regulatory advice about a breach and who has to be notified
Every site is built by Elisabeth Samuels and the Salterra team — a company building websites since 2011. Not a reseller, not an offshore queue. The same person who scopes your project writes the pages and hands over the logins.
Send us the address and we will check what you are running against the published advisories, then tell you what we find in plain language — free either way.
What website security costs in Des Moines
Mostly nothing, because most of it should not be a product.
Hardening at build time is included in every site we build and is not sold separately. Plugin discipline, per-person accounts, two-factor, disabled file editing and the rest are what a competent build includes, and charging extra for them would be charging you to do the job properly.
Ongoing monitoring is part of a maintenance plan rather than a separate line — the two are the same work seen from different angles, and splitting them into two invoices would be marketing rather than service. Incident work on a site that is already compromised is quoted after we look at it, because until we know how they got in, any number would be invented.
What moves the number
- Whether this is prevention or a live incident — prevention is planned work, an incident is an investigation and cannot be quoted blind
- How many plugins and how much custom code there is — more moving parts is more to check and more places for an entry point to hide
- Whether a working, tested backup exists — with one, recovery is straightforward; without one, the site may have to be rebuilt
- How long it has been going on — something caught in a day is a much smaller job than something that has been quietly running for months
Frequently asked questions about website security in Des Moines
How do I know if my website has been hacked?
The common signs are: the browser or Google warns visitors before they reach you; pages you did not write appear, often about pharmaceuticals or casinos; the site redirects somewhere else, sometimes only for visitors arriving from a search; an administrator account exists that nobody created; the site suddenly slows down; or your host emails about abuse. If you see any of those, change the hosting and admin passwords from a different device and take the site offline while you work out what happened.
What does website security cost in Des Moines?
Hardening at build time is included in every site we build and is not sold separately. Ongoing monitoring is part of a maintenance plan rather than a separate invoice. Cleaning a site that is already compromised is quoted after we look at it, because until we know how they got in any number would be made up.
Can you clean a hacked site?
Yes — but be honest with yourself about the clock. If you need someone in the next hour, we are not the right call: we are a small team without a 24-hour incident desk, and there are specialist emergency firms who will answer immediately. If it is not that urgent, we will take it on: isolate the site, find the entry point, rebuild from a clean backup, close the route and rotate every credential.
What is included in security monitoring?
Watching for the specific things that indicate trouble — the site going down, an admin account nobody created, files changing when nobody deployed, and published advisories landing for software you run. Each has a written response prepared before it is needed.
Do you back up my website, and where?
Yes, and off the server — a backup sitting on the machine you would lose is not a backup. More importantly we test that a restore actually works rather than trusting the job’s success message. Backups run as part of maintenance and the detail lives on the hosting page.
Is WordPress secure?
WordPress core is well maintained and patched quickly. Almost every compromise we see comes from something bolted onto it — an out-of-date plugin, an abandoned theme, or a shared administrator password — rather than from WordPress itself. Which is why the honest security advice is boring: run fewer plugins, update them promptly, and give people their own logins.
Tell us what you sell. Get your number.
Send us what your business does and roughly how many pages you think you need. You will get the number and a timeline in writing.
Takes about a minute. No call, no obligation.
We reply to everything within one business day.