Jay's Ideas
For a long time, it was perfectly reasonable to set up a WordPress site and then mostly forget about it. You had a homepage that looked professional, a contact form that worked, and your business was visible to the world. As long as the site stayed online, nobody needed to think about the software running underneath.
Most small business owners still operate this way, and I understand why. You are running a clinic or a shop or a two-person consultancy, and you have a hundred things on your plate more urgent than whether a plugin is out of date. For years that was a fine way to live. The people breaking into websites were mostly hunting for big targets, and the work took skill and patience and time.
What changed is the speed. Attacks are no longer run by people browsing for a target. They are run by software that sweeps the entire internet continuously, testing every site it finds for one thing: a known-weak version of something. It is not personal. It is a net cast wide and pulled fast, and it does not care whether you are a contractor, a dentist, or a food bank.
The tools to do this used to require real skill to operate. Now they are cheap, quick, and largely automated. A plugin that has gone a year without an update is a door that software will find and rattle, thousands of times a day, without anyone deciding you are worth attacking.
A fair question at this point, and one a reader put to me on LinkedIn: is any of this actually new? People have been breaking into websites for as long as there have been websites, and the business of attacking them has always had its own specialists and supply chains. So what is different about this moment?
Part of the answer is that flaws are found faster. Give a model a plugin's code and it will point at the weak line in seconds. It does not get bored at four in the morning. But finding the flaw was never the bottleneck. What changed is who can act on what gets found.
Until recently, the person who understood the weakness and the person who could build an attack around it were usually the same rare individual. Now someone with no talent for the work can point a model at a target and let it iterate. Guardrails are easily bypassed. The skill has moved out of the attacker and into the software, and the software is handed out freely.
In recent weeks a new generation of small "flash" models arrived that are dramatically smarter than the cheap models of a year ago, far cheaper per request, and fast enough to sit inside a loop that reacts to what it finds. I want to be precise here, because it would be easy to read this as an argument against open models. Small open-weight models running on hardware you control, are one of the most useful things to happen to this industry. I use them every day.
My point is not that they are dangerous. My point is that capability released into everyone's hands arrives in everyone's hands, and that now includes people whose business model depends on your site going down.
The uncomfortable conclusion is that the defense which actually matters is unglamorous maintenance, done continuously and without anyone needing to remember. Better models help on both sides of the fence, and I use them on mine, but you cannot out-run automated software with a manual habit. Whatever intelligence is watching your site has to be standing there every hour, not whenever somebody remembers to log in.
That is a problem I set out to solve at SRVpress, and it is the reason the hosting here looks a little different from a typical control panel.
It starts with the server itself. The web server and the PHP engine that actually run WordPress are kept on current releases by an automated process that tests each new release before it goes live, and puts the previous version back automatically if the site does not come back up.
Then there is the site. Every site's code and configuration is recorded in a history the website itself cannot erase. Every hour, the current state is compared against the last state a human approved. That distinction matters, because if you compare a site only to yesterday, an infection quietly becomes the new normal by breakfast. Compared to an approved baseline, it shows up as a change.
On top of that, I use tripwires for classic signs of trouble, such as executable code appearing in the folder that should only ever hold images. These are things that are either normal or a clear signal, with very little in between.
When a tripwire fires, the system cleans the report to strip out passwords, login keys, and tokens. Then an advanced AI security analyst instantly reviews it, and a real human gets a copy too.
Backups get the same treatment. There is more than one copy, and the copies live on separate virtual machines on separate continents, so a very bad day on the server is a recoverable day rather than the end of the story.
Nobody can promise a WordPress site is impossible to break into. What I can offer is that if someone does get in, the tampering becomes visible quickly and recovery is a practiced, documented step rather than a scramble.
SRVpress is not the cheapest hosting you can buy, and it's not trying to be. I keep the business deliberately small, and every client has my phone number. You are not paying for a glossy control panel or an anonymous support queue. You are paying for the hours that went into building this and the hours that go into watching it.
Security is a service you buy from someone who does it every day. If you're not sure whether your site's software is current, or when anyone last checked what changed on it, call or email me.
