Service

WordPress Security

The quiet war your website is already in — and how ours win it daily

Every WordPress site on the internet gets probed constantly, whether anyone's watching or not. Ours are watched. This page is the itemized list of what stands between your website and the people rattling its doorknobs.

Let’s talk → See the work

Pink Wig Foundation website by Becker Design

Pink Wig FoundationNonprofits

The Boring List

You were promised we'd happily bore you with this. Consider this the request granted.

On the Enhanced Ongoing Services page we mention a long list of security measures and offer to bore you with it on request. This page is that list, because we think you should get to read it before anyone asks you to trust it.

First, the honest framing: WordPress powers something like half the web, which makes it the most attacked software on earth — and also the most defended. A neglected WordPress site is genuinely easy pickings. A properly hardened, properly updated one is a miserable target, and the difference between those two states isn’t luck. It’s a stack of specific, unglamorous measures, running every hour of every day.

The Other Half

Most hacked websites weren't attacked. They were abandoned.

The overwhelming majority of compromised WordPress sites fall through a known hole in an outdated plugin — a fix existed, and nobody applied it. That’s why security here is inseparable from management: software kept current on a weekly-or-urgent rhythm, every update preceded by a full backup, licenses that never lapse. The glamorous defences get the headlines; the updates do most of the actual protecting.

And behind all of it sits the unpretty final answer: daily backups, kept apart from the site. If the worst somehow happened anyway, we restore and move on — which is a very different day than the one where a hacked site is also the only copy.

Why It's Worth It

What a compromise actually costs

A hacked website isn’t an IT inconvenience; it’s a business problem wearing your name. Google blacklists compromised sites — your listing replaced by a warning screen — and climbing back takes far longer than falling did. Visitors who get a browser warning don’t come back to check on you later. For organizations handling sensitive interactions, the stakes compound: when we built for AVI Health & Community Services, protecting health-related traffic wasn’t a feature request, it was the ground floor. The Pink Wig Foundation‘s donation traffic gets the same treatment for the same reason.

None of which is meant to scare you. It’s meant to explain why we treat a small business website with the seriousness usually reserved for bigger ones — the attackers don’t check your headcount first.

AVI Health & Community Services website by Becker Design

AVI Health & Community ServicesHealth Care & Nonprofits

Under Guard

Four layers, itemized

Every website we host runs all four. None of them are things a standard hosting account includes, and none are things you'll ever have to think about.

01
A firewall in front of everything
Malicious traffic gets filtered at the server level before it ever reaches WordPress — known bad actors, vulnerability probes, scrapers, and the whole catalogue of common attack patterns, turned away at the property line.
02
Logins that fight back
Repeated password guesses earn an automatic ban. Predictable usernames are blocked outright, and the tricks attackers use to discover valid accounts simply don’t work. The login page is the front door, so it gets the most locks.
03
Known weak points, welded shut
WordPress ships with legacy openings that most sites leave exposed — old protocols, upload folders that will happily run code, installation scripts that should never be public. We close every one of them as a matter of course.
04
Scanning, and someone who answers it
Malware and vulnerability scanning runs in real time, and security patches jump the queue — when a serious fix ships, it goes on immediately rather than waiting for the weekly round. Alerts reach a human who acts on them. That last part is rarer than it should be.

Axiom IndustriesConstruction Companies
Elance SteelConstruction Companies & Contractors
PDS IncHealth Care

The standing arrangement

Every site here is under management

We designed these sites, we host them, and we keep them current — the same standing arrangement that comes with every build.

Let’s talk

The track record

Work you can go and check

Every build below is live, hosted here, and still looked after. Click any of them and judge for yourself — that is the whole argument.

Cory K. — Pink Wig Foundation★★★★★
Becker has been a huge supporter of the Pink Wig Foundation since day one. He built our website to perfection and is always a text away for any issues we may have! He has also done all my design for my King Management business and it is top notch! If I could put 10 stars I would! He’s the best in the business.
Erin L. — Legal Aid Saskatchewan★★★★★
Becker Design & Media worked with Legal Aid Saskatchewan on its website facelift – and wow, what a great job! Bryn was extremely receptive to our wants, needs, and ideas from Day 1. He understood our unique market. Throughout the project, he maintained excellent communication and answered all of our questions. The website was completed on time and on budget. I recommend Becker Design & Media for anyone looking to work with a professional company that understands your goals and can seamlessly bring them to reality.

The related workExplore all projects

Pink Wig FoundationNonprofits
→ View project
Coal Creek FestivalTravel & Tourism & Arts and Music
→ View project
Greenline DistributorsRestaurants
→ View project
Legal Aid SaskatchewanLaw Firms
→ View project

FAQ

Three security questions, answered honestly

Our site was hacked. Can you help?
Bring it to us and we’ll take a look — case by case, honestly assessed. Sometimes a compromised site can be cleaned, patched, and moved onto our infrastructure; sometimes the honest answer is that a rebuild costs less than the archaeology. Either way you’ll get the real answer, with reasons, before anything is billed.
Is WordPress itself safe?
Yes — with an asterisk. The software is scrutinized by more security researchers than almost anything on the internet, and holes get patched fast. The asterisk is that patches only protect sites that apply them. WordPress with discipline is safe; WordPress on autopilot is how the horror stories start.
Do we need to do anything ourselves?
Use a real password, don’t share your login, and tell us if anything ever looks strange. That’s the whole list. Everything else on this page is our job, running whether you think about it or not.

Peace of Mind

Find out what your website's actually running

Most owners have no idea what protection their site has — which usually means the answer is "very little." Send us your address and we'll tell you what we can see from the outside, and what we'd want standing guard if it were ours.

Let’s talk

What We Do

Explore all our services

Not sure where to start? Try one of the Service options below.

SRV.01
Website Hosting & Enhanced Ongoing Services
Enterprise-grade web hosting, updates, upkeep, backups, security and support for service-based business websites
→ View Service
SRV.02
WordPress Design
Hand-built WordPress websites designed around one business at a time: bespoke CMS underneath, 100% custom design on top, and a structure that makes the site easy to find, update, and live with for years.
→ View Service
SRV.03
SEO
Honest search engine optimization: a properly built website, relevant content written by humans, and the technical layer Google actually checks — the long game, played straight, with no ranking promises.
→ View Service
SRV.04
Responsive Web Design
One website, correct on every screen and for every person: phone-first layouts, full cross-browser support, and accessibility done properly — the way every site should be built, and every one of ours is.
→ View Service
SRV.05
WordPress Hosting
Purpose-built WordPress hosting on high-end cloud servers in Canada and the US: a tuned stack that serves pages from memory, round-the-clock monitoring, and a standing failover copy on separate infrastructure.
→ View Service
SRV.06
WordPress Management
WordPress management from the people who built the site: updates applied backup-first, changes made for you — usually the same day — and a website that never gets the chance to fall behind.
→ View Service
SRV.07
WordPress Security
Layered, always-on WordPress security: a server-level firewall, hardened logins, welded-shut weak points, and real-time scanning that reaches a human — plus the update discipline that does most of the protecting.
→ View Service
SRV.08
WordPress Performance Optimization
Website speed as two disciplines: hand-built lean pages on tuned, cached servers — then monthly performance checks and server-side watching that keep them fast for years, not weeks.
→ View Service
SRV.09
WordPress Backups
Daily backups to three separate places — the server, independent cloud storage, and a folder you hold yourself — kept for a full year, with restore instructions in plain English. No single point of failure, including us.
→ View Service
SRV.10
WordPress Migration
Website moves without downtime: out of rented builders, off builds that fight you, onto infrastructure somebody watches — content harvested, addresses forwarded page by page, search standing intact.
→ View Service
SRV.11
Email Marketing
The email channel, set up properly once: a newsletter platform you control, templates that match your website, signup woven through the site, and authenticated sending so your messages actually reach inboxes.
→ View Service
Contact Us
Not sure where to start? Let’s Chat.
Chances are we can find a way to help you out. We’re pretty good like that. Let’s talk some shop.
→ Let’s Talk Shop