Small site security rarely calls for a new theme just because a plugin is out of date. It calls for a pass with a finish line: core and plugins updated or deliberately pinned, an admin URL that isn’t the default if the platform allows it, forms that stop obvious spam without blocking real mail, and a backup you’ve actually restored once. A rebuild fixes none of that if the same plugins and the same form come back on day one.
The pass starts from an inventory, not a scanner printout pasted into a slide. Name the platform, the theme, the active plugins, and the one that hasn’t had a release in two years. Inactive plugins still on disk get removed or get a reason to stay. A scanner that lists eighty “issues,” including missing headers you haven’t decided on, is a later conversation. The first question is whether the contact form’s plugin is abandoned.
How do you handle updates, the admin path and small site security?
Updates happen on a copy, or with a backup taken the same day, followed by a click-through of the home page, one service page, and the form. If an update breaks the layout, roll back and pin the version, and write the pin down. “Updated everything” with no versions and no rollback isn’t a pass. It’s a hope. Versions belong in the note so next month doesn’t start from zero. The WordPress hardening guide lists the supported ways to do most of this.
The admin path is about noise and about stolen password lists hammering the default address. Changing it doesn’t replace a unique password or limit who has an account, but it does cut the dumb traffic. Use the platform’s supported method, test the new login, and don’t advertise the path in a public footer. Two accounts are enough for a small site: one owner, one maintainer. A shared “admin” password from 2019 is the finding, even if every plugin is current.
Form spam is a content problem and a mail problem. A honeypot or a lightweight check beats a puzzle your real customers fail on a phone. Confirm a real message still arrives and that the mailbox isn’t a personal inbox nobody watches on weekends. If the form stores submissions in the site, those entries are private data, so restrict who can export them. A pass that hardens the login and leaves every lead in a world-readable table did only the visible half.
What do you leave alone on purpose?
Leave the visual design alone unless a template is the vulnerability, which is rare compared with an old form plugin. Leave legal copy to the client. Don’t install a second security suite next to one that’s already active; two firewalls logging over each other make a site slower and no clearer. If a firewall is there, configure it.
The customer-facing reasons for all this are in our post on data security and trust. This post is about the work itself.
What should the closeout note say?
Write it as actions taken and items refused. Updated this list. Removed these inactive plugins. Login path changed, tested. Form checked with one real message. Backup file named, restore not attempted, if that’s the truth. A restore you’ve never tried is a file, not a plan, and the note should say which it is. Refused: a full redesign, a new analytics stack, a mandatory captcha on every field.
That refusal is the point of calling it a pass. The client can still hire a redesign later, but shouldn’t have to hire one to get the form plugin off an abandoned release. Scope for this kind of visit sits on the security service and website support pages, next to the website audit that should have caught the abandoned plugin before the inbox filled with junk. Questions about your own site? Contact us.