Website Hosting

Professional, managed, secure and dedicated website and cloud server hosting from an ISO 27001 certified UK data centre.

Plans

Keeping the website itself secure

A hardened server protects the platform the website runs on. It does not patch the website's own code. Every site — WordPress or otherwise — needs its own maintenance routine, and since 2026 the consequences of skipping it have changed considerably. You will need to maintain, or ask us to maintain, the code on a weekly or monthly basis: the latest PHP versions, WordPress core changes, plugin updates, on-site security systems, login protection and other security measures.

Automated, AI-driven attacks now find and exploit an unpatched site faster than a human ever could.

The older pattern of website compromise was noisy: defacement, spam pages, a redirect somebody noticed within a day. The current pattern is the opposite. An automated intrusion establishes isolated access at core level, changes nothing a visitor would see, and stays put. It becomes a long-term back door — quietly exfiltrating customer and payment data over weeks, or using the site as infrastructure for onward attacks, phishing and fraud carried out in your name. By the time it surfaces, the damage is to your data, your customers and your reputation at once.

The maintenance routine every website needs

1. Patch monthly

   Core, plugins, themes and any third-party libraries updated on a monthly cycle at minimum, with critical security releases applied as soon as they land — not at the next convenient moment.

2. Remove what is no longer used

   Audit the site for legacy and forgotten code: deactivated plugins still sitting on disk, abandoned themes, old staging copies, test scripts, unused admin accounts and stale integrations. Dormant code is still executable code, and it is where automated scanners look first.

3. Harden and monitor WordPress

   WordPress sites must run a properly licensed, correctly configured and actively maintained Wordfence installation — firewall rules current, malware scanning scheduled, alerts going to somebody who reads them. An installed-and-forgotten security plugin provides reassurance rather than protection.

4. Penetration test

   Test the live site the way an attacker would, on a regular schedule and after any significant change. Testing is how you find the misconfiguration or exposed endpoint that patching alone does not close.

5. Back up, and keep the history

   Backups are now the single most important control you have, because a silent compromise may go unnoticed for a long time. Keep multiple independent copies and retain them for two to six months where storage allows — a seven-day rotation is worthless if the back door was installed in month three. Restores should be tested, not assumed.

We can take the website side on too

If you would rather not run that routine yourself, we offer it as a separate managed service. Every site starts with a fixed-fee audit of what it is actually running, followed by a quoted piece of remediation work to bring it up to date, and then an ongoing plan: Essential for brochure sites, Secure for business sites holding customer data, and Business Critical for eCommerce and anything where downtime costs money. Costs depend entirely on what the audit finds, which is why the audit comes first.

Full details and pricing are on our website maintenance and security page, or enquire about your website and we will scope what it needs.