Website security and malware removal
Website security services, from hardening to hack recovery
DevoraTech provides website security services from Tangier, Morocco, for businesses worldwide. We harden your site, keep it updated and backed up, watch it for signs of trouble, and clean it up and bring it back online if it is hacked. The work follows the security guidance that WordPress.org and Google publish for site owners.
Read moreShow less
Security work lowers the risk of a hack and shortens the recovery when one happens. WordPress's own hardening guide is plain about it: "Sometimes prevention is not enough and you may still be hacked." That is why we plan backups you can restore and a recovery process before anything goes wrong.
Security belongs with our website maintenance services, next to website speed optimization, on WordPress, WooCommerce, Shopify, PrestaShop and custom-coded sites. Security work is done as a one-off job or as part of a maintenance plan.
- Hardening, updates and backups
- Malware removal and recovery
- Accounts kept in your name
For whom
Who it is for
- A business whose site has not been updated for months
- A site showing spam pages, strange redirects or a warning in the browser
- An online store that keeps customer accounts and orders
- A company that no longer knows who has access to its site
What we fix
What leaves a site open to attack
Software left behind
The platform, the theme and the plugins all release security fixes. Since version 3.7, WordPress has applied its minor and security releases automatically on most sites, but major releases, themes and plugins still need someone to update them and check the site afterwards. As WordPress's documentation puts it, older versions are more prone to hacks than newer ones.
Weak and shared passwords
One password shared by the whole team, a former employee still listed as administrator, an FTP account nobody uses. Google's advice to site owners starts with good passwords and with SSH and SFTP for file transfers, and WordPress asks for two-step sign-in on every administrator account.
Plugins and themes from unknown sources
A free copy of a paid theme, or a plugin downloaded from a random site, may come with code you never asked for. WordPress advises getting plugins and themes only from the WordPress.org directory or from well-known companies.
No backup you can restore
A backup stored on the same server as the site, or one that nobody has ever restored, may fail on the day it is needed. WordPress recommends backing up both the database and the files, weekly for a small site and daily for a busy one, with copies kept in different places.
What you get
What our website security services include
Security review
Versions, plugins and themes, user accounts and their roles, file permissions, hosting settings, backups and HTTPS checked, with a written list of risks ranked by urgency.
Hardening
The measures from the WordPress hardening guide that fit your site: strong, unique passwords and two-step sign-in for administrators, no account named "admin", file editing turned off in the dashboard, tight file permissions, the admin area on HTTPS, and limits on repeated sign-in attempts. Equivalent settings on the other platforms.
Updates
Core, theme and plugin updates applied with a backup first and a test of the main pages afterwards. A plugin that no longer receives updates is flagged, with a replacement proposed.
Backups
The database and the files backed up on a schedule that matches how often your site changes, with copies kept away from the server and a restore tried, so we know it works.
SSL and HTTPS
A valid certificate on every address of the site, renewed before it expires, and every page served over HTTPS. As WordPress notes, HTTPS is free in many cases.
Access control
Each person with an account of their own and the WordPress role their work needs, from Administrator to Subscriber. Former staff and agencies removed, hosting and file access reviewed, and our own access kept as a separate user you can remove.
Monitoring
The site watched for downtime, unexpected file changes and malware, and the Security issues report in Google Search Console checked, so a problem is caught early.
Malware removal and hacked website repair
Infected files, spam pages and harmful redirects cleaned, the entry point closed, and a review requested from Google once the site is clean, following the steps below. We do this as a one-off job or as part of a maintenance plan.
Platforms
Security on each platform
Each platform leaves a different part of security to you. We write in the plan what we look after and what stays with the platform or the host.
WordPress and WooCommerce
Most of the work sits here: the core, the theme, the plugins, the users and the server settings. Our WordPress security service follows the hardening guide published on WordPress.org, and on WooCommerce stores we test the checkout after each change.
Shopify
Shopify runs the hosting and the software. Security work covers the staff accounts and their permissions, the apps installed and any custom code in the theme.
PrestaShop
Updates of PrestaShop and its modules, the back office accounts, the server settings and the backups.
Custom code
Framework and library updates, server settings, and who can reach the code and the database, for sites and web apps built with Laravel or other custom code.
Process
Hacked website repair, step by step
1. Contain
The site taken offline, or replaced by a maintenance page served from outside the infected server, and your host told about the hack. Google's help for hacked sites and the WordPress documentation both ask for these first steps.
2. Lock every door
Unknown accounts deleted, every password changed (hosting panel, FTP or SFTP, database, site administrators), and everyone signed out of WordPress by renewing its secret keys.
3. Copy, then clean
A copy of the infected site kept for analysis, then the site restored from a clean backup when one exists. Otherwise, the core files replaced with fresh ones of the same version, plugins and themes reinstalled from trusted sources, and altered files such as .htaccess cleaned.
4. Find the way in
The weakness the attacker used, such as an outdated plugin, a stolen password or a server setting, identified and closed.
5. Update, then change passwords again
Everything updated to its latest version, and the passwords changed a second time once the site is clean, as WordPress advises.
6. Ask Google for a review
When Google shows a warning, a review is requested from the Security issues report in Search Console, with the details of what was cleaned and fixed.
Services
Other services
Website speed
Load time and Core Web Vitals measured and worked on, for a website you already have.
Website maintenance
Updates, backups, security and fixes for websites that already exist.
Outsourced web development
Web development delivered from Tangier for companies and teams abroad.
Questions
Website security services: your questions
Can you guarantee that my site will never be hacked?
No one can. Security work lowers the risk and helps catch a problem early, and your plan lists what is done: updates, hardening, backups and monitoring. If a hack still happens, a clean backup and the recovery steps on this page are ready.
My site has been hacked: what should I do first?
Note what you see and when, tell your host, and change the passwords of every account linked to the site: hosting, FTP, database and administrators. Avoid deleting files at random, because a copy of the infected site helps find how the attacker got in. Then send us the site address and what you noticed.
How do I know if my website has been hacked?
The signs listed by WordPress include a warning from Google or from an antivirus, a host that suspends the site, new users you did not create, and pages that look wrong when you open them. Google adds spam pages you did not write, hidden text or links, and redirects that send some visitors to harmful pages. Search Console's Security issues report shows what Google has found on your site.
How much does a malware removal service cost?
It depends on the platform, the size of the site, the kind of hack and whether a clean backup exists. We look at the site first, then send a written quote. The clean-up is done as a one-off job or as part of a maintenance plan. Request a quote with your site address and what you see.
Do you offer a WordPress security service for sites you did not build?
Yes, we take over sites built by other agencies or developers. We start with a security review of the theme, the plugins, the users and the hosting, then propose hardening, a cleanup or a maintenance plan, in writing. The accounts stay in your company's name.
Will Google remove the warning once the site is clean?
A review can be requested in Search Console once the site is clean, the weakness is fixed and the site is back online. Google says malware reviews take a few days and reviews of hacked spam up to several weeks; once a review is approved, the warnings in browsers and search results are removed within 72 hours. We send the request with the details of what was done, through your Search Console access.
Tell us what worries you about your site
Tell us your site address and what concerns you: a security review, hardening, backups or help with a hacked site. We come back with questions, then a written plan and a quote.