In this guide · 8 sections
- 01What a website security service actually does
- 02Updates and hardening: the one-off and the routine
- 03Web application firewall: what it adds and what it costs
- 04Backups, admin MFA and monitoring
- 05How to compare website security offers
- 06One-off hardening vs a monthly plan
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A good website security service covers five layers: updates, a web application firewall, off-site backups with a tested restore, MFA on admin logins and monitoring with alerts. Hardening is mostly a one-off job; updates, backups and monitoring need doing every month.
What a website security service actually does
Attackers rarely target a small business by name. Automated tools scan millions of sites for known weaknesses: an outdated plugin, a default admin username, a password reused from another breach. The OWASP Top 10, the standard list of web application risks (latest edition 2025), is mostly about the same problems: broken access control, outdated components, weak authentication and misconfiguration.
A security service exists to close those gaps and keep them closed. It is less about one clever product and more about routine: patch, block, back up, watch.
| Layer | What it stops | One-off or ongoing |
|---|---|---|
| Updates (core, theme, plugins) | Attacks on known, already-fixed bugs | Ongoing, weekly to monthly |
| Hardening | Easy wins such as file editing from the dashboard, unused plugins, old admin accounts | One-off, review yearly |
| Web application firewall (WAF) | Common attack patterns, bad bots, login floods | Set up once, rules update automatically |
| Admin MFA and login limits | Password guessing and stuffing | One-off, check when staff change |
| Off-site backups | Losing the site after a hack, bad update or host failure | Ongoing, daily, plus test restores |
| Monitoring and alerts | Hacks or downtime nobody notices for weeks | Ongoing |
Updates and hardening: the one-off and the routine
WordPress's own hardening guide starts with updates: older versions are not maintained with security updates, and you should delete plugins you do not use. Automatic updates for minor WordPress releases have existed since version 3.7, but plugin and theme updates still need someone to apply them and check the site afterwards.
Hardening is the one-off part. Typical items:
- Remove unused plugins, themes and old user accounts (ex-staff, ex-agency).
- Disable the built-in theme and plugin file editor (the DISALLOW_FILE_EDIT setting in WordPress).
- Rename or remove any account called admin and give each person their own login.
- Force HTTPS and add basic security headers.
- Give the database user only the permissions WordPress needs.
Done properly, hardening takes a few hours. After that the value is in the routine: someone applying updates every week or month and testing that forms, checkout and bookings still work afterwards.
Web application firewall: what it adds and what it costs
A WAF sits in front of your site and blocks requests that match known attack patterns before they reach WordPress. It can run as a plugin on your server or as a cloud service such as Cloudflare, which also hides your server's address and absorbs traffic floods. Our guide to web application firewalls covers the difference in detail.
- Cloudflare FreeIncludes a free managed WAF ruleset and basic DDoS protectionUS$0
- Cloudflare ProUS$25/mo billed monthly; adds the broader Cloudflare Managed RulesetUS$20/mo billed annually
- Cloudflare BusinessUS$250/mo billed monthly; for higher-risk or high-traffic sitesUS$200/mo billed annually
Typical SME choiceFree or Pro plan
Source: Cloudflare plans page, approximate, as of October 2026. Prices in US dollars.
A WAF does not replace updates. It buys time when a new plugin bug is published, but a site with ten outdated plugins behind a firewall is still a soft target.
Backups, admin MFA and monitoring
Backups. Keep copies off the server, so a hacked or failed host does not take the backups with it. WordPress's guide suggests regular snapshots of files and database in a trusted location, and notes that keeping older copies helps if a hack is only noticed days later. Ask for 30 days of daily copies at minimum, and proof of a test restore. Our guide on restoring a website backup shows what a restore involves.
Admin MFA. Every admin and editor account should need a second factor. This stops the most common takeover route: a reused password from another breach.
Monitoring. At minimum, uptime checks every few minutes, SSL and domain expiry alerts and a check that Google has not flagged the site. Better services also watch for file changes and new admin users.
How to compare website security offers
Quotes are hard to compare because providers bundle the layers differently and use different names for the same thing. Ask the same questions of each one.
Questions to ask every provider
The last two questions separate good offers from weak ones. A plan that excludes clean-up shifts the risk back to you, and a provider who registers the firewall or backups under its own account makes leaving harder. Our WordPress hack repair guide lists what a clean-up should include.
One-off hardening vs a monthly plan
A one-off hardening job suits you if
- The site rarely changes and has few plugins
- Someone in-house can apply updates each month
- You mainly need the set-up done right once
A monthly plan suits you if
- The site takes payments, bookings or leads daily
- Nobody has time to update and test every month
- You want backups and alerts checked by someone else
Do it yourself or get help?
If you are comfortable in the WordPress dashboard, you can handle much of this yourself: delete unused plugins, turn on automatic updates, add MFA and connect Cloudflare's free plan. The hard parts are testing after updates and making sure backups really restore.
Our Website Security Hardening (S$290) does the one-off work: updates, unused plugins and users removed, admin 2FA, a web application firewall, security headers and an off-site backup. For ongoing cover, Care Plus (S$349 a month) adds monthly updates, daily backups, monitoring and a quarterly security review, on accounts you own.
Frequently asked questions
A complete service covers software updates, one-off hardening such as removing unused plugins and old accounts, a web application firewall, multi-factor authentication on admin logins, off-site backups with a tested restore, and monitoring that alerts someone when the site goes down, is flagged by Google or changes unexpectedly.
For many small brochure sites, a free WAF such as Cloudflare's free plan with its managed ruleset, combined with regular updates and admin MFA, gives reasonable protection. Sites that take payments or have many plugins benefit from paid rulesets. No firewall makes up for outdated software, so updates matter more than the plan level.
Security updates should be applied as soon as practical, ideally within days of release, and all other updates at least monthly. Test key functions such as forms, checkout and bookings after each round, and keep a recent backup so you can roll back if an update breaks something.
Not fully. Good managed hosting can include server firewalls, malware scanning and backups, but it usually does not update your plugins, remove old admin accounts, enforce MFA or test the site after changes. Check exactly what the host covers and fill the gaps yourself or with a provider.
Contact the provider immediately and ask them to follow the clean-up terms in your agreement. Change all admin, hosting and database passwords, check for unknown users, and confirm a clean backup exists. Before signing any plan, check whether malware clean-up is included or charged separately.