Website security and monitoring for heating companies

What security care covers

Website security is not one product. It is a set of habits applied every month:

• Logins: who can sign in, with what level of access, and whether that list is still accurate
• Software: keeping plugins and themes current, which is where most known weaknesses live
• Certificates: keeping the padlock valid so browsers never warn your visitors away
• Monitoring: noticing unexpected file changes, new admin users or sudden redirects
• Recovery: clean backups stored somewhere separate, and a plan for using them

Who needs it

Every site needs basic security, but some heating companies carry more risk than others:

• Companies where several staff members, past and present, have had website logins
• Sites with a long plugin list, especially plugins added for one season's promotion and never removed
• Businesses that take bookings, financing enquiries or payments through third-party tools embedded in the site
• Anyone whose site has shown a browser warning or a search engine notice in the past

What is included

The exact scope is written down for your tier. The work typically includes:

1. A login audit. Every account is listed. Former staff are removed, shared passwords are replaced with individual accounts, and admin access is limited to the people who need it.
2. Two-step sign-in on admin accounts, where the platform supports it.
3. Plugin and theme review. Abandoned or unused items are flagged for removal.
4. Change monitoring, so a new admin user or an unexpected file change is noticed.
5. Certificate and domain renewal tracking.
6. An incident plan that names who does what if the site is compromised, so nobody is improvising during a crisis.

Timeline

• First two weeks: login audit, plugin review and the first full backup stored off the server.
• First month: monitoring in place and the incident plan agreed with you.
• Ongoing: monthly review of logins and software, plus action whenever monitoring raises a flag.

How results are measured

• Number of admin accounts, which should match the number of people who genuinely need one
• Pending security updates, which should stay at zero
• Incidents found, how they were found, and how long the fix took
• Whether a clean, recent backup exists off the server at any given moment

Privacy and email: two related rules to know

Security overlaps with two federal laws that touch every Canadian business website. PIPEDA governs personal information collected in commercial activity, and Alberta, BC and Quebec have their own similar private-sector laws. Canada's Anti-Spam Legislation requires consent, sender identification and a working opt-out for commercial emails and texts. A hacked site that sends spam from your domain can create real headaches under both. We summarise these laws only; confirm your own obligations with a qualified adviser.

Signs your site may already be compromised

Watch for these warning signs and report them the same day: visitors being sent to unrelated sites, pages in another language you did not write, new admin users nobody recognises, a sudden drop in search traffic, or a browser or search engine warning on your domain.

Mistakes to avoid

• One shared admin password for the whole office. When someone leaves, you cannot tell who did what.
• Leaving a former web designer as an administrator. Remove access the day the relationship ends.
• Treating a hack as only a technical problem. If customer information may have been exposed, there may be privacy steps to take as well.
• Restoring an infected backup. Restore from a point before the compromise, then close the gap that let it in.

Security works best alongside updates and backups and managed hosting. Tiers and prices are on the pricing page.