Website Monitoring

What we watch

Why file integrity matters most

Availability monitoring is useful, but many hacks do not take a site down. The attacker wants the site to keep running so it can serve spam, redirect visitors or collect details. What usually changes is the files: a modified core file, an extra script in the uploads folder, a theme file with a few added lines.

The WordPress hardening guide recommends file integrity monitoring for exactly this reason, and names tools such as OSSEC and Git that can track changes ^[1]. It also stresses logging: logs are your best friend when it comes to understanding what is happening on a site ^[1]. We set up both, at a level that suits a small business budget.

Google's alerts

If Google detects hacked content, malware or deceptive pages, it reports them in the Search Console Security Issues report, and affected pages can show warnings in search results and browsers ^[2]. Google describes that report as the place to check whether issues exist or have been fixed ^[2]. We connect Search Console to the alert routing so that a new message reaches a person the same day.

What happens when an alert fires

1. The alert is checked against the change log. If it matches a planned update or your own edit, it is closed and noted.
2. If it does not match, we look at what changed and whether it is harmful, and tell you what we found.
3. If it is a security problem, we agree the next step with you, usually a quick containment followed by malware removal.

How quickly step 2 happens depends on the plan you choose. Response times are stated in writing, and we do not describe any plan as round-the-clock unless it is.

Setting up who hears what

Alerts are only useful if they reach someone who will act. During set-up we agree a short routing list: availability problems to you and to us, security alerts to us with a copy to you, and Search Console messages to whoever manages the site day to day. We send a test alert down each route to confirm it arrives, including to phones if you want them. The list is written into your plan document so it is easy to update when staff change.

What monitoring cannot see

Monitoring watches the website. It does not watch your email accounts, office computers or the payment provider's systems, and it cannot tell the difference between a staff member making an unusual change and an attacker using that staff member's stolen password. That is why account hygiene matters alongside it: every person with their own login, two-step sign-in for administrators, and old accounts removed promptly. Our hardening service covers those foundations.

Watching quiet periods

Many owners only look at their site when they are changing it. Monitoring keeps watch in between, including over holidays and slow seasons when nobody is logging in, which is exactly when an unexpected change would otherwise sit unnoticed for weeks.

Getting started

Monitoring takes a little setup before it becomes useful. The first step is a baseline: a record of the site's files, users and settings as they are when monitoring begins. Every later alert compares against that baseline, so it is worth making sure the site is clean first. If there is any doubt, we suggest a check or cleanup before monitoring starts, otherwise the baseline could include something that should not be there.

During setup we ask you to:

• tell us who should receive alerts, and who should not, so a technical warning does not land in a general inbox;
• let us know about planned changes, such as a redesign or a new plugin, so expected changes are not reported as suspicious;
• confirm whether Search Console is set up, so Google's own security alerts reach the right person;
• decide what should happen if an alert arrives outside business hours.

The first few weeks usually bring a handful of alerts from normal activity, such as a plugin writing its own cache files. We tune the rules during that period so later alerts mean something. Fewer, clearer alerts are better than many that everyone learns to ignore.

Your monthly summary

Each month you receive a one-page summary: availability for the month, updates applied, any alerts and what they turned out to be, and anything we recommend. It is written for a business owner, not a developer.

Monitoring works best alongside regular updates and tested backups. All three are combined in our maintenance plans.