A blog set up using WordPress that earns money or draws in visitors is a different type of asset from a hobby blog; whenever real business opportunities occur, your attention turns to the business and consequently the site’s backend becomes work that no one carries out.
The phrase “website handover” denotes two distinct things; in certain situations it means an agency giving a finished website to a client. In this case, though, it has a different meaning since it consists of handing over the ongoing security and backend maintenance of your WordPress site to a reliable team while you keep ownership of everything.
I never deal with this from a distance since my website, Piki Templates, is continually being targeted by malicious bots and scrapers who always try to break into my database, and therefore I would like to thank companies like Bluehost provide such services for carrying out an outstanding job in keeping my website safe from such attacks. At the moment I can focus on improving the services that my company offers rather than having to spend my time, money and other resources on securing the website. It makes more sense to leave all the trouble associated with keeping the WordPress safety database secure to a service by paying a small fee. The entire job will be done by their team. You needn’t at all worry about the security of your website; it will be looked after by their professionals and they will give you a full report via their online services.
It is because of that experience that all that follows is the case.
Why a growing WordPress site gets harder to protect
In the case of a hosted service like Blogger, Google take care of the servers and manage the infrastructure; you then lose control and also have to abandon any responsibility. With self-hosted WordPress, the situation is the opposite: you gain access to a wide range of plugins and true control over the features, and it is your own responsibility to ensure the security of your hosting account, your database and your installation. The host looks after the building but does not keep an eye on what you have installed inside it.
It is not necessary to know who you are if you want to be attacked; automated bots search for outdated plugins, weak logins and exposed files, and scrapers copy the content on a large scale. The most common ways of gaining access are through brute-forced logins, unpatched plugins or themes, and injection attempts aimed at the database.
When one of your websites is compromised, it has a negative effect on your brand. Spam links, redirects, scripts that slow down your pages, and the warnings given by your browser or by search engines all harm your authenticity and credibility. You are really having to pay in order to protect four things: the security of your site, its authenticity, the trust of your customers and your own control of your data.
A security plugin is not a security team
It is commonly believed that if you have a good security plugin then you are safe. The plugin, operating inside the same WordPress installation that it is meant to protect, mainly searches for known problems. Nevertheless, someone still has to read the warnings, ensure that the updates are carried out in a timely way, decide which ones are real and then carry out the necessary cleaning when an incident does manage to get through.
Although the plugin can send an alert it has no means of deciding which action to take; therefore leave it in place as a layer, merely not regard it as the one keeping an eye on things.
What a bad handover looks like
A bad handover is easy to recognise:
- Your own admin password is shared over email or chat, with no separate account for them
- The scope says “we’ll keep it safe” and nothing more
- Backups sit on the same server as the site and have never been test-restored
- There is no named contact and no stated response time
- The domain or hosting is registered in the provider’s name, not yours
A system that operates in this way reverses the arrangement of all the items. Each individual is assigned a personal, revocable administrative account along with a written statement specifying what is covered. The backups are stored off the server and the restore procedure is verified. You are given a named point of contact who has a written response time, and your domain, hosting and database stay in your name. Lock-in occurs whenever you are still left with all the components in place after one day has passed, rather than having a simple handover.
Putting providers side by side
As there are so many different services available, it isn’t worthwhile evaluating them based on their sales pages. Bluehost security firewall is a good one to begin with—open up a number of them and then assess each one using the same criteria:
- Scope: malware scanning and cleanup, core/plugin/theme updates, firewall and bot filtering, uptime monitoring
- Backups: how often, where they’re stored, whether restores are tested
- Reporting: how often, and whether you can read it without a developer
- Access: their own revocable account, never yours
- Response: a stated time to respond when something breaks
- Pricing: flat monthly or per incident, and what is billed separately
- Exit: how you leave and what you take with you
Where the free tier stops
The tools which are given free of charge establish their position, and the security reports that they provide show exactly what they filter.
The main problem when I move my primary website, Piki Templates, from Blogger to WordPress is security, since with Blogger I was using Google’s servers and they looked after all the various aspects for me; the difficulty lies in the fact that Blogger has limitations as far as the control it provides over different website features are concerned, for instance when it comes to plugins which make it easy to carry out any kind of task that would otherwise be impossible. Although WordPress does offer such excellent features and functionalities, the disadvantage is that you have to take full responsibility for securing your own hosting server. That is the reason I have chosen to use the free version of Cloudflare, and it has nearly blocked all the bots and automatic malicious attacks, even supplying me with proper reports via the Analytics section in the Security tab. The issue is that Cloudflare only achieves full security through its premium plans.
You will have to read the reports and sort them even if you subscribe to the premium tier unless someone is hired to carry out the sorting.
Where I landed
It is easier to arrange for a small and steady monthly charge than it is to have an emergency cleaning.
As you know, I have been using Cloudflare to secure my website, but having looked at the prices of Cloudflare’s premium plans, I believe it is rather pointless to pay that much merely for security. It would be better to purchase a service from trustworthy providers who will act as a shield for your website; in fact, they will carry out all the things you ask for since their professional team stays in contact with you when you hand over the website. In my opinion, they serve as the backbone of your website. Eventually, I have succeeded in protecting both my servers and the database of my WordPress website from attacks. You can browse the internet and see that there are thousands of different types of services on the market. Make a side-by-side comparison and then select the one that is suitable for you.
In assessing the scope, you should not refer to the sales page and have to ensure that each account stays in your name.
