Website security monitoring is a set of automatic checks that tell a named person when something on your site changes in a way that signals an attack or an outage. Our website security monitoring service sets up those checks, routes the alerts and writes the response steps: file changes, new administrators, failed updates, DNS changes, certificate expiry, blocklist status, uptime and backups. You find out about a problem on the day it starts.

Why monitoring matters after a site is secure

A site that passed an audit last month can be vulnerable today, because new holes in plugins and server software are published all the time. Monitoring closes the gap between audits.

It also shortens the time a compromise goes unnoticed. Under GDPR Article 33 the 72-hour notification window starts when the controller becomes aware of a personal data breach; a company that learns about a break-in weeks later has already lost the chance to act early. OWASP lists security logging and alerting failures as a category in its Top 10:2025 for the same reason.

What we monitor

We watch the signals that usually come before an incident on a small or mid-sized business site. The exact set depends on the site and is agreed in the scope letter.

Signal Why it matters Source or basis
File integrity of the site code Web shells and injected scripts change files Incident practice; OWASP Top 10:2025
New or changed administrator accounts Attackers add accounts to come back OWASP Top 10:2025, broken access control
Update status of CMS, plugins, themes Outdated components are a common entry point WordPress hardening guide
TLS certificate expiry and renewal Maximum validity falls to 100 days from 15 March 2027 and 47 days from 15 March 2029 CA/Browser Forum Ballot SC-081v3
Renewal reminders Let's Encrypt ended expiration emails on 4 June 2025 Let's Encrypt
Google Safe Browsing and Search Console security issues Browsers warn visitors, and Google Ads uses the same lists Google Safe Browsing; Search Console Help
DNS records, including mail records A changed record can redirect the site or the mail Domain operations practice
Uptime and response time Outages and slowdowns can be the first sign of an attack CISA DDoS guidance
Backups A missed or broken backup turns an incident into data loss GDPR Art. 32(1)(c)

How alerts reach the right person

Every check has a recipient, a channel and a written next step. An alert that goes to a shared inbox nobody reads is the same as no alert.

We set the routing with you: who gets security alerts, who gets technical ones, which channel (email, messenger, ticket) and what counts as urgent outside working hours. Each alert type has a one-page runbook entry: what it means, what to check first, who decides, and when to call for incident response.

Backups that are proven by a restore

A backup is proven only after it has been restored and the site worked from it. We set the schedule, the retention and a storage location separate from the site's own server and accounts, then run a test restore and record the date, what was restored and how long it took.

GDPR Article 32 names the ability to restore availability and access to personal data in a timely manner as one of the security measures a controller should have. A dated restore test is the evidence that you can.

What you receive

The engagement ends with working checks and the documents to run them.

  • Configured monitoring for the agreed signals on each site.
  • Alert routing to named people, tested with a sample alert.
  • A runbook: one entry per alert type with the first steps and the escalation.
  • A backup schedule, storage outside the site's server, and a dated restore test.
  • A short monthly or quarterly summary format, if you want regular reports.
  • On request, security updates applied by us after testing, and incident response when an alert confirms a compromise.

What we need from you

We need access to the hosting or server, the CMS administrator account, DNS and Search Console, the names of the people who receive alerts, and a signed scope letter. If your developer keeps the update work, we agree how monitoring and their work fit together.

Boundaries

This service sets up and documents monitoring for websites and the servers they run on. Round-the-clock watching of your whole company network, endpoint detection and managed response are available on request from a separate provider, named in the proposal. Monitoring reduces the time to notice a problem; it cannot prevent every attack, and it reports only on the signals that were agreed.

Risks of relying on a plugin alone or an unowned setup

A monitoring plugin that lives on the same server as the site goes silent when that server is compromised. Alerts sent to a former employee or an unread inbox produce the same result.

A freelancer can install a tool, and then the question of who reacts at night stays open. A chatbot can suggest tools without knowing your hosting or your team. We set up the checks, the routing and the runbook together, test them with a sample alert, and hand over a documented setup.

Who does the work

The engagement is contracted with INNOVA CONSULT LTD., Ottawa, Ontario (Corporations Canada, Corporation Number 1522612). The team keeps more than 80 websites of its own under daily vulnerability checks. Software licences, if a paid tool is needed, are billed at cost without vendor commissions.

Cost

Monitoring gets a fixed price in the scope letter after a 30-minute call. The main factors are the number of sites, the checks you need and who handles updates.

Related services

Sources (checked 2026-10-23)

Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.