5. Your site’s security

Security is the part of your website you should think about least, because it is the part we watch most. It runs continuously, without you starting it.

5.1 What it is doing

• Blocking the automated attempts that hit every small website daily — thousands of them, most of which you will never hear about.
• Scanning your site’s files for anything that should not be there.
• Hardening the parts of WordPress that attackers reach for first.
• Watching sign-in attempts and shutting out anyone guessing passwords.

5.2 The one thing that affects you

If someone types the wrong password too many times, that person gets locked out for a period. This is deliberate — it is what stops an attacker guessing their way in. It also means you can lock yourself out after a few failed attempts on a bad morning.

If that happens, wait it out or tell us and we will clear it immediately. Do not keep trying; each attempt extends the block.

5.3 What is yours to do

Very little, and that is the point. The two things that genuinely help:

• Use a strong, unique password for your website — not one you also use elsewhere.
• Tell us when someone leaves. If a staff member or contractor had a login, we should remove it that day.

5.4 What to leave alone

Do not change security settings, add or remove security plugins, or act on emails telling you your site is infected and offering a fix. Those emails are almost always a scam. Forward anything alarming to us instead — we can tell you in a minute whether it is real.

5.5 If you think something is wrong

Tell us straight away. Signs worth reporting: unexpected content on your pages, visitors reporting warnings, or being redirected somewhere strange. Do not wait to be sure — a false alarm costs us five minutes, and a real one caught early costs far less than one caught late.