One plugin. Twenty websites.
About five years ago, a client called me because their website was sending visitors to a scam site.
At the time I was hosting around twenty client sites on my own server. When I dug in, I found how they got in: one plugin, on one client's site, that I'd forgotten to update. From there the attackers worked their way up to the server itself, and then into every other site on it.
It took me weeks to get everyone back online. Some businesses were down for days. I told every client exactly what happened, I apologized, and I discounted a lot of work. Most of them were understanding, and many still work with me today. But I had to earn that trust back, and I haven't forgotten what that felt like, for them or for me.
What stuck with me is that I hadn't done anything unusual. I ran WordPress the way most people run WordPress. There were just a lot of things to keep up with, and it only took one of them slipping.
By day, I work in cybersecurity. Seven years of building security software for large organizations, and more than a hundred small businesses, nonprofits, and schools I've helped personally. The same lesson shows up at both ends. Every product, every service, and every connection is something that can go wrong. The safest setups I've seen have the fewest moving parts.
Your website is the front door of your business.
For most businesses it doesn't need a database, a login page, or a stack of plugins, so I build sites without them. No plugins to update, nothing to forget, and nothing on the server for anyone to break into.
If a hacked website is the kind of thing that keeps you up at night, I understand. I'd like to help you stop worrying about it.
What each one carries
A typical CMS site
- A dozen or more plugins, each from a developer you've never met
- A database holding whatever your forms collected
- A public login page anyone can find
- Fonts, trackers, and widgets from other companies
- Updates forever, and one miss is enough
- When it breaks, restore a backup and hope it's clean
- Owned by whoever holds the admin login
A Nothing-to-Hack site
- No plugins
- No database
- No login page
- No scripts from other companies
- Nothing on the site to patch
- The backup is the code, so it rolls back in minutes
- You own the domain and the Git repository
The fair objections.
- Can I still edit my site?
- Yes. One benefit of hiring an engineer instead of a drag-and-drop builder is that I can build the editing you actually need and nothing else. If all you need is to post a blog once a month, I engineer exactly that, with nothing else exposed. For everything else, send me the change and it is live within two business days. More on editing your site.
- What about SEO?
- It generally gets better, because a clean structure is easier for search engines and AI assistants to read. When you move, I carry over every address with a redirect and connect Search Console. Nobody can honestly promise rankings, and I won't. More on moving your site.
- I'm not ready to leave WordPress.
- Then don't. I looked after well over a hundred WordPress sites and I still look after plenty. A care plan keeps yours healthy, and when you are ready, part of what you have already paid comes off the rebuild. See Site Care Plus.
