WordPress Security for Law Firms

Why a law firm's website needs more than a cleanup

A law firm's website rarely holds case files, but it carries the firm's name, takes enquiries from prospective clients, and often shares hosting, email or passwords with systems that do. When it is hacked, removing the malware is only part of the job. You also need to know how the attacker got in, what they could reach, and to be able to show what was done about it.

What we do for law firms

• Malware removal: a forensic copy of the site first, then malware, backdoors and injected spam removed from files and the database, and the entry point found and closed.
• A written incident report: the timeline, how the attacker got in, what they changed, what we removed, and what can't be determined from the evidence.
• Hardening: unused plugins removed, two-factor login, least-privilege accounts, and file-change monitoring.
• Ongoing care: scheduled updates and checks, month-to-month or for a fixed term.
• Security audits before a client security questionnaire, an insurance renewal or a website rebuild.

How we handle access and confidentiality

• Nothing is accessed before a scope of work is signed. Confidentiality terms are part of every contract.
• We work through an individual account you create for us, from one dedicated IP address, and every session is logged.
• Credentials you share are kept in an encrypted password manager and deleted when the work ends.
• Forensic copies stay available to you for 30 days after the engagement, then are deleted.
• We never name your firm as a client, or publish anything that could identify it, without your written permission.

When a website cleanup isn't enough

If the site collects contact-form submissions, runs a client portal, or shares credentials with email or practice-management software, a compromise may have reached client information. In the US, ABA Formal Opinion 483 says lawyers must make reasonable efforts to determine what happened after a breach, and must inform current clients when material client information is involved or likely involved.

Our incident report records what can be established from the website and its hosting. It is not a legal breach assessment. Where client data may be involved, we work alongside your counsel, your cyber insurer and any forensics firm they appoint, and we preserve the logs before cleaning so that evidence isn't lost.

From a real engagement

A law firm's backup held ten malicious files hidden in five folders and disguised as a plugin and a theme, including a tool built to find and attack other websites on the same hosting account. We traced what each file did, checked the live site and closed the attacker's access.

Getting started

• The first look is free: we check the site from the outside, and within one business day you get a written, fixed quote.
• For a hacked site, work starts the same or next business day after you approve the quote.
• A cleanup is a one-time job with no subscription, and includes 30 days of monitoring and a free re-clean if the site is reinfected in that time.

Questions from law firms