One plugin. Twenty websites.
About five years ago, a client called me because their website was sending visitors to a scam site.
At the time I was hosting around twenty client sites on my own server. When I dug in, I found how they got in: one plugin, on one client's site, that I'd forgotten to update. From there the attackers worked their way up to the server itself, and then into every other site on it.
It took me weeks to get everyone back online. Some businesses were down for days. I told every client exactly what happened, I apologized, and I discounted a lot of work. Most of them were understanding, and many still work with me today. But I had to earn that trust back, and I haven't forgotten what that felt like, for them or for me.
What stuck with me is that I hadn't done anything unusual. I ran WordPress the way most people run WordPress. There were just a lot of things to keep up with, and it only took one of them slipping.
By day, I work in cybersecurity. Seven years of building security software for large organizations, and more than a hundred small businesses, nonprofits, and schools I've helped personally. The same lesson shows up at both ends. Every product, every service, and every connection is something that can go wrong. The safest setups I've seen have the fewest moving parts.
Your website is the front door of your business.
For most businesses it doesn't need a database, a login page, or a stack of plugins, so I build sites without them. No plugins to update, nothing to forget, and nothing on the server for anyone to break into.
If a hacked website is the kind of thing that keeps you up at night, I understand. I'd like to help you stop worrying about it.
