// Scenario 03
Cybersecurity for the sites and tools you already run
Most small companies are not hacked by a genius. They are hacked by a script that found an old plugin, a forgotten subdomain or a backup file left in public. This scenario closes those doors and keeps watching them.
- For
- SMEs on WordPress, CRMs, shops and custom apps
- Already running in
- this website
- Scenario
- This is a scenario we deliver, not a past client result.
Why it matters in 2026
Since 2024, attackers use automation and AI to scan the whole internet for known flaws within days of their publication, so “we are too small to be a target” no longer holds. In Europe, the NIS2 directive has applied since October 2024 and pushes security duties onto many mid-size companies and their suppliers; large clients now send security questionnaires before they sign. In Morocco, Law 05-20 on cybersecurity and Law 09-08 on personal data set the same direction. A website, a CRM or a shop that nobody watches is now a business risk, not a technical detail.
You need this if
- Your website, CRM or shop runs plugins or modules nobody has reviewed in months.
- You have subdomains, test sites or old tools you are not sure are still online.
- Your backups exist, but nobody has ever restored one to check it works.
- A client or partner has sent you a security questionnaire and you did not know how to answer it.
How we deliver it
1 Map what is exposed
We list everything the internet can reach: domains and subdomains, admin pages, forgotten apps, public files and archives, open ports, and every plugin and version you run.
2 Harden
We update or remove what is outdated, block code from running in upload folders, add security headers, enforce two-factor sign-in for every admin, remove unknown accounts and rotate exposed keys.
3 Prove recovery
We set up backups stored away from the server and restore one to a test copy, so you know recovery works before you need it.
4 Watch
A watchdog checks your sites daily and right after every update: files that changed, pages that broke, certificates about to expire, new admin accounts. It emails you in plain words when something needs a look.
What you get
- A written map of your attack surface, with what we fixed
- Hardened sites and tools, with two-factor sign-in for every admin
- Backups you have seen restored
- Daily monitoring with plain-language email alerts
- An incident plan: who to call, what to switch off, how to restore
What we will not promise
Nobody can honestly promise that you will never be attacked. We promise that the easy doors are closed, that you will know quickly when something changes, and that you can restore a clean copy.
Questions
Is this a penetration test?
It is broader and more practical: we fix what we find and keep watching afterwards. If a client or regulator asks for a formal penetration test, we prepare you for it and work with the tester.
We use WordPress. Is that the problem?
No. WordPress is safe when it is kept up to date and configured properly. Most incidents come from abandoned plugins, weak admin accounts and missing monitoring, all of which we handle.
Will this break our site?
Every change is tested on a copy first or applied with a rollback ready, and the watchdog checks the live pages right after.