Web maintenance · Security
We protect the application, infrastructure and data your business relies on. We connect updates, access control, traffic filtering and recovery in a security service tailored to your project.
Layered protection
A complete service connects infrastructure, applications, people and recovery. Each layer has its own controls and is checked alongside the others.
WAF, firewall, TLS, exposed services and hosting configuration.
Code, dependencies, uploaded files and external integrations.
Accounts, sessions, permissions and separation of user data.
Logs, alerts, backups, restores and response procedures.
What we can implement
We choose controls according to project architecture and business impact. For each intervention, define access, ownership, checks and the deliverable.
We inventory applications, domains, servers, accounts and integrations. We relate vulnerabilities to exposed data and operations so important risks are addressed first.
We cover the components managed within the project: CMS, extensions, themes, frameworks, libraries, runtimes and server services. We check compatibility before deployment and critical functions afterwards.
We configure web-request filtering through a WAF and network rules through a firewall, according to the infrastructure. We review exposed services, administrative access, TLS certificates and file permissions.
We review who can view, change, approve or export information. We implement least-privilege access, multifactor authentication where supported, and rules for sessions and privileged accounts.
We reduce abuse in forms, comments, registrations and sign-in. We combine server-side validation, honeypots, rate limits and bot checks suited to the workflow. We also review authentication for email sent by the domain.
We address root causes in the application: data validation, queries, output handling, authorisation and uploads. We review API keys, webhooks and data separation between customers or organisations.
We define monitored events and alert routing: sign-ins, permission changes, exports and critical operations. We limit sensitive data in logs and define access and retention.
We prepare copies of databases, files and configuration, with separate access and suitable retention. We test restores and define which data must be recovered and the required operational timeframe.
For a compromised system, we define the scope, contain the impact and preserve information needed for analysis. We clean affected components, fix the entry point and verify recovery.
Controlled updates
We review the full chain of components. An update is complete after functions and integrations are tested, not merely when installation ends.
CMS, themes, modules, plugins and commercial components.
Frameworks, packages, libraries, SDKs and API connectors.
PHP, Node.js, Python and other runtimes used by the project.
Operating system, web server, databases and containers, according to available administrative access.
On managed hosting, we coordinate system changes with the provider. On SaaS platforms, we review configuration, integrations and changes delivered by the operator.
Built around how you work
Security integrated into code, sessions, APIs and background jobs. We check direct resource access and operations between systems.
Operator and administrator roles, access to assigned customers, private documents and tracked exports. Former collaborators’ accounts are revoked.
We protect accounts, checkout and payment integrations. We review processor notifications, order validation and automated abuse while preserving the purchasing journey.
Manuscripts and documents accessible only to assigned people. We review author–reviewer–editor roles, approved transitions and version history.
Updates, administration accounts, forms, comments and files. We review abandoned extensions, suspicious redirects and unauthorised changes.
Organisation separation, invoice and report access, integration keys and invitations. We explicitly test that one account cannot access another customer’s data.
Example · editorial platform
In a system with authors, reviewers and editors, permission to sign in is only the beginning. Document access and manuscript-state transitions are validated separately.
Permissions are checked again for every operation.
How we work
Testing stays within the authorised scope. For intrusive checks, agree the environment, time window and permitted operations in advance.
We identify systems, data, authorised access and operations that must remain functional.
We prioritise risks, prepare backups and testing, then agree changes and the working window.
We apply controls and check relevant sign-in, forms, payments, integrations and permissions.
You receive a change record, test results and a review schedule for the systems in scope.
What you receive
Choose a one-off intervention or recurring administration. The quote specifies the systems in scope, review frequency and response times.
Frequently asked questions
Yes. The service covers custom applications, CRM, stores, portals and workflow platforms. We start with architecture, code, dependencies, roles and infrastructure. For supplier-managed systems, we define what we configure directly and which interventions are coordinated with that supplier.
We inventory all relevant components, not just plugins: platform, code, libraries, runtimes and infrastructure. Update components managed within the project after checking compatibility. In SaaS, the provider updates the platform; we review settings, integrations and effects on your business workflows.
A WAF filters web requests, while a network firewall controls permitted communications. Fixes for code, permissions, uploads and integrations form a separate layer. We review them together: filtering rules and root-cause remediation have different roles.
Test rules against the routes actually used and check legitimate traffic, forms, relevant crawlers and webhooks. Adjust thresholds according to observed behaviour, review false positives and retain a rollback procedure. Also check speed after the intervention.
Yes. Establish authorised access and scope, isolate affected components and analyse available logs and changes. The intervention includes cleanup, entry-point remediation, rotation of relevant credentials and restore verification. We document findings and follow-up controls.
The quote reflects the number of applications and environments, technologies, available access and system condition. We separate assessment, remediation and recurring administration. Licences, external services, review frequency and response times are specified in the project quote.
