Website security service in Japan – updates, WAF, backups and tamper monitoring

Why WordPress sites get targeted

WordPress runs a huge share of the web, and its core and plugins are open source. When a vulnerability is published, automated scanners look for every site using the affected plugin and attack them all at once. Company size does not matter – a small shop's website is scanned just like a large brand's.

Most WordPress vulnerabilities are found in plugins and themes. The sites that get hit usually share a few traits:

• Plugins or themes have not been updated for months
• Unused plugins and themes are still installed
• A plugin is no longer maintained by its developer
• The admin username is "admin" or the company name
• The server still runs an old PHP version
• Backups live only on the same server, or do not exist

Open the Plugins and Updates screens in your dashboard and count how many updates are pending and how many plugins you no longer use. That alone gives you a fair picture of your current risk.

What a security incident looks like

A hacked site rarely just goes offline. The damage often reaches customers and partners before you notice.

• Defacement and redirects: unknown pages appear, or visitors are sent to spam shops or gambling sites
• Search warnings: Google flags the site and browsers warn visitors away
• Data leaks: contact form entries or member data get stolen
• Spam relay: your server sends spam, and your own email stops reaching inboxes
• Suspension: the hosting company shuts the account, email included

Malicious redirects are often set to hit only search or mobile visitors, so the home page looks normal to you and the owner is the last to know. If you already see strange pages or warnings, start with our guide to hacked WordPress site recovery.

The security basics that cover most risks

Get the fundamentals right before adding any special tools. Working through this list from the top removes a large part of the risk.

• Updates: keep WordPress core, plugins and themes current. Back up first, then check pages and forms afterwards
• Clean-up: delete unused plugins and themes, and replace plugins that are no longer maintained
• Login protection: a non-obvious username, a long password, two-factor authentication and a limit on login attempts
• Access review: remove accounts of former staff and past agencies, and give editors only the rights they need
• Server settings: run a PHP version your host still supports, and serve every page over HTTPS
• Forms: add spam protection such as reCAPTCHA and avoid storing more personal data than needed

If your site is not fully on HTTPS yet, see moving your site to SSL. Some of these items are set once, others need a monthly look, so put them on a maintenance schedule together with the protections below.

WAF, backups and tamper monitoring

Once the doors are locked, add a layer that stops attacks early and a safety net that lets you notice problems and roll back fast.

• WAF: a web application firewall blocks malicious requests before they reach the site. Most Japanese hosting plans include one you can switch on in the control panel, or you can place a cloud WAF such as Cloudflare in front
• Backups: daily automatic backups of files and database, several generations kept, with a copy stored off the server. Test a real restore a few times a year
• Tamper detection: a plugin or service that watches for file changes and alerts you, plus Google Search Console set up to report security issues
• Uptime monitoring: an external check that alerts you the moment the site goes down

A WAF can occasionally block legitimate actions, so after enabling it, confirm that contact forms and saving in the dashboard still work. Thinking in three steps – prevent, detect, restore – makes it easy to see what your site is missing.

Security works when it is part of maintenance

Protection only lasts if someone keeps it running. The typical story behind a hack: the person in charge gets busy, updates pause, and a vulnerability is published in the meantime. Whether you handle it in-house or outsource it, a fixed routine helps:

• Weekly: check for updates and review alerts from tamper detection and monitoring
• Monthly: back up, update core, plugins and themes, then check key pages and forms
• Every few months: review users and permissions, unused plugins and the PHP version
• Once or twice a year: rehearse a restore from backup and confirm hosting and domain contract details

Keep hosting, the domain and admin logins in your company's name and control. If only an agency knows them, a lost contact during an incident means a slow response. For handing over updates and the rest of the routine, see WordPress maintenance.

How UNANOBO handles website security

Send us your site's URL. We look at what can be checked from the outside – WordPress version, SSL, how the site loads – and build a free demo of your site in a cleaner, easier-to-protect setup, with outdated themes and plugin dependencies sorted out. You see it working on your computer and phone before deciding anything.

The process is free demo, feedback, launch, growth. After launch, updates, backups, WAF settings and tamper alerts run as part of maintenance, and you get a message whenever something needs your attention. The founder handles everything personally, by message in Japanese or English. The same approach works for sites that are not on WordPress.