Security

A hacked website is not just an IT problem. Google's Safe Browsing flags compromised sites and can remove them from search results entirely, and under Article 32 of UK GDPR you have a legal obligation to protect any personal data your site collects, including contact form submissions. For a small business in Southampton, the cost of a breach is rarely the clean-up. It is the weeks of lost visibility afterwards.

We build security into every site we deliver rather than selling it as an upgrade, and we take on hardening and recovery work for Hampshire businesses whose existing sites were built without it.

How We Secure Your Website

1. Secure Development Practices

• 1

  Reviewed, typed code

  TypeScript, validated inputs and reviewed changes, closing off SQL injection and cross-site scripting at the source rather than filtering for them later.

• 2

  Smaller attack surface

  Custom Next.js builds have no plugin ecosystem, no universally known admin URL and no abandoned themes waiting to be exploited.

• 3

  Dependency auditing

  Third-party packages are the most common route into a modern site. We audit and update them rather than pinning versions and hoping.

2. Security Headers and HTTPS

• 1

  Full header set

  Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, configured properly rather than left at defaults.

• 2

  TLS that renews itself

  Automatic certificate renewal so HTTPS never silently expires on a bank holiday, plus HTTP to HTTPS redirects across the whole site.

• 3

  Verified externally

  Check what your site currently sends with our free website health scanner.

3. Server and Hosting Security

• 1

  Hardened from first boot

  Firewall rules, SSH key-only access, fail2ban and automatic security updates, applied before a site is ever deployed.

• 2

  Isolated services

  Applications run in Docker containers as non-root users, so one compromised component cannot reach the rest of the host.

• 3

  EU data residency

  Hosting inside the EEA keeps your UK GDPR position simple. See our cloud services page.

4. Access Control

• 1

  Least privilege

  Staff accounts get the access they need and nothing more, with separate credentials per person rather than one shared login.

• 2

  Two-factor authentication

  Enforced on admin areas, hosting, domain registrar and email, which is where most real-world compromises begin.

• 3

  Offboarding process

  A documented list of what to revoke when someone leaves. Dormant admin accounts are a standing risk.

5. Backups and Recovery

• 1

  Automated and offsite

  Nightly database and file backups to separate storage, so a compromised server does not take the backups with it.

• 2

  Restores actually tested

  A backup nobody has restored is a hope. We script and run the restore periodically. See Bash and automation.

• 3

  Written recovery plan

  Who does what, in what order, if the site is defaced, encrypted or the host disappears.

6. Monitoring and Patching

• 1

  Continuous monitoring

  Uptime, certificate expiry, unusual traffic and error rates watched around the clock with alerts to a phone.

• 2

  Scheduled patch cycles

  Operating system, runtime and dependency updates applied on a schedule, with urgent security fixes applied immediately.

• 3

  Spam and abuse protection

  Rate limiting, honeypots and automated blocking so contact forms do not become an inbox problem.

7. Compliance and Legal Standards

• 1

  UK GDPR Article 32

  Appropriate technical measures documented, so a breach does not also become an enforcement problem.

• 2

  Cookie consent done properly

  Non-essential cookies blocked until consent is given, with the consent signals passed to analytics and advertising platforms.

• 3

  Payment security

  Card data never touches your server. We integrate PCI-compliant providers such as Stripe and PayPal. See our eCommerce service.

Security Packages

• Site Health & Security (£495) for a one-off audit of an existing site covering security, performance and SEO, with critical fixes included.
• Business Site Hosting and Shop Site Hosting for ongoing patching, monitoring and tested backups as part of managed hosting.
• Ultimate Business Bundle where you want the site, security, hosting and marketing handled by one team.

Further reading: website security for UK businesses in 2026 and GDPR-compliant eCommerce setup. If you suspect your site is already compromised, contact us and treat it as urgent.