Website Security

Monthly Website Security Check-Ins for Small Businesses

Every website I host or maintain gets a security check-in once a month. You get a plain-English summary of what I checked, what I changed, and what needs your decision.

This page lists the checks, what they cost, and what they do not promise.

What I check every month

CISA's advice for small businesses comes down to four habits: update your software, turn on MFA, use strong passwords, and spot phishing (CISA's small-business basics). These six checks keep the website side of that list done.

  1. Email security. Your domain's SPF, DKIM and DMARC records. They let other mail servers trust mail from you, and they stop strangers from sending as you. Google and Yahoo now require them for many senders (Google's sender guidelines).
  2. Website and server hardening. Software updates, the settings that close the usual doors, and a backup that lives off the server. I test a restore at least once a quarter.
  3. Network protection. Your domain registration, your certificate, and the firewall in front of the site. Plus the month's downtime, if there was any.
  4. Logins and access. Who has admin access, whether each admin uses a second factor, and which old accounts to remove. This covers the systems where you gave me access.
  5. Vulnerability scanning. Known holes in WordPress, plugins, custom code, and the hosting account. I check them against the public vulnerability lists.
  6. A security note for your team. One short note a month about a real threat your staff will meet, and the one thing to do about it.

What you get

Your monthly report gets a security section. It says what I checked, what changed, and what I recommend. Nothing changes on your accounts without your OK.

The $75 a month hosting and maintenance plan includes the checks. If you host elsewhere and I maintain your site, the checks come with that maintenance too.

Two optional add-ons

These are separate projects with their own quote. You know the price before I start.

Active Directory security assessment

For offices that run Windows Active Directory or Microsoft Entra ID. I review the admin groups, stale accounts, password rules, and MFA coverage with read-only tools. You get a scored list of fixes with an owner for each.

Purple team exercise

A scheduled test of your defenses. With your written sign-off and an agreed scope, I run attack scenarios with AI-assisted red and blue team agents and check whether your alerts fire. You get a report that lists what your defenses caught, what they missed, and the fix for each gap.

What this does not promise

I cannot promise that a website never gets hacked. Nobody can. What I promise is that the checks happen every month, you see the results, and I name problems plainly.

For medical practices: this does not make you HIPAA compliant. It keeps the website side in order and tells you what I see.

Who this is for

Clients on my hosting and maintenance plan, and clients whose site I am building. Work beyond the plan is $75 an hour. Registered 501(c)(3) nonprofits get 20 percent off, as with every PMDS package.

Start here

Email paul@pmds.info or call (443) 866-7356. If you already work with me, your next monthly report will carry the first check-in.

Email Paul

PMDS, Paul Mulligan
Baltimore, Maryland, serving Baltimore City, Baltimore County and the rest of Maryland
(443) 866-7356 · paul@pmds.info