# Cybersecurity > WordPress security for organizations that hold member records and payments: layered defences, regular monitoring, and a plan for incidents. Cybersecurity Your members trust you with their data. We protect the WordPress websites that hold member records, payments, and personal information, with layered defences, regular monitoring, and a plan for the day something goes wrong. The work Security that’s built in, watched, and tested. Most breaches start with something small, like an out-of-date plugin, a reused password, or an account nobody remembered. We close those gaps before they’re found, watch for anything that changes, and build your website so a problem in one place can’t easily reach another. Standards The foundations we put in place. Every website is different, so its protection is too. These are the foundations we start from, then build on as your website and your risks require. Applied and tested. WordPress, themes, and plugins kept current, tested before release. Threats stopped early. Firewall rules, bot filtering, and rate limits on sign-in and forms. Two-factor, always. Two-factor sign-in for everyone with access to your website. Least privilege. People get only the access their role needs. Supported only. Commercially supported plugins, reviewed before they are installed. Stored separately. Nightly backups kept away from the live website. Watched, not hoped for. Log reviews and malware scans, with alerts reviewed by a person. A plan for the worst day. Containment, restoration from a clean backup, and a written account of what happened. In practice What looking after your security looks like. Every website is different, so the work is too. These are some of the ways we protect the websites we look after, including the routine work that prevents most problems and the plan for when something does go wrong. UpdatesFirewallSign-inAccessBackupsMonitoringEmailPrivacyResponse Updates, tested before they go live. Most attacks use known weaknesses in out-of-date software. WordPress, plugins, and themes are kept current, and each update is tested on a copy of your website first. Security releases first. Applied quickly, not left for the next routine update. Tested on staging. Checked on a copy before they reach your website. Unused plugins removed. Less software means fewer ways in. Threats stopped before they reach your website. A web application firewall filters traffic before it reaches WordPress, blocking password guessing, injection attempts, and bad bots. Rules that keep current. New threats are blocked as they appear. Rate limits. On sign-in, search, and forms. Bot filtering. Spam and scrapers kept out, real visitors let in. Two-step sign-in for everyone with access. A stolen password is one of the most common ways into a website. With two-step verification, a password alone is not enough. Authenticator apps and security keys. Stronger than codes sent by text message. Limited attempts. Repeated failures are slowed, then blocked. Sessions that expire. Idle sign-ins end on their own. The right access for each person, and no more. Each person gets only the access their role needs, and accounts are reviewed regularly, so former staff and past vendors don’t keep the keys. Roles that fit your work. Custom roles, like a registrar, when the defaults don’t fit. Regular account reviews. Unused accounts are found and removed. A record of changes. Who changed what, and when. Backups that have been tested. A backup only matters if it restores. Nightly backups are kept away from your website and restored on a test server to prove they work. Nightly and separate. Stored away from the website they protect. Restore tests. A full restore, checked, on a regular schedule. Weeks of history. So a problem found late can still be undone. Watched by a person, not just software. Uptime checks, malware scans, and file monitoring run around the clock, and a person reviews what they flag. Uptime checks. From outside your hosting, so outages are caught early. Malware and file scans. Unexpected changes are noticed and explained. Alerts reviewed. A person decides what matters, so nothing is lost in the noise. Email in your name, sent only by you. SPF, DKIM, and DMARC records tell other mail servers which email really comes from you, which protects the people you serve from phishing that uses your name. Records set up and checked. For your website, newsletters, and office email. Reports reviewed. So you know who is trying to send as you. Delivered, not junked. Renewal notices and receipts reach inboxes. Personal information, collected with care. Forms collect only what they need, sensitive details are protected, and entries are deleted on a schedule, in line with your privacy policy. Only what you need. Fewer fields, less to protect. Kept for a set time. Entries deleted on a schedule you choose. Consent recorded. For newsletters and tracking, as privacy law expects. A plan for the day something goes wrong. If something does happen, it is contained, your website is restored from a clean backup, and you get a written account of what happened and what changed. Contained quickly. Accounts locked and access closed. Restored cleanly. From a backup made before the problem. Explained plainly. Including whether anyone needs to be notified. Layers Where each kind of attack is stopped. No single tool stops everything, so each layer is set up for specific threats. An attack that gets past one meets the next, and if the worst does happen, your website can be restored from a clean, tested backup. For your board Six questions your board should be able to answer. If any of these take more than a minute to answer, it is worth a conversation. Who can sign in to the website, and do they all use two-factor authentication? When was a backup last restored as a test? Which plugins on the website are no longer maintained? Where does member data go when someone submits a form? Who is told if the website goes down overnight? Does the website keep the promises in our privacy policy? Free website review Check your website’s security basics. Enter your website address and we’ll review what it reveals to any visitor, including encryption, security headers, email protection records, and software hygiene. We never attempt to sign in or probe for vulnerabilities. Questions Fair questions about security. Can you review a website you did not build?+ Yes. We review the code, plugins, hosting, and user accounts, then recommend what to fix first. Do we need security if we use a managed host?+ Yes. Managed hosting protects the platform, but the website itself still needs updates, account controls, and monitoring. What happens if we are hacked?+ We contain the problem, restore your website from a clean backup, and help you understand what happened, including whether you need to notify anyone. Next step Let’s talk about your website’s security. Tell us about your website and any concerns you have. We’ll review your request and follow up in plain language.