Why Albanian sites get hacked
Not because they are special: because they are easy. Automated bots search the whole world for WordPress sites with old plugins, simple passwords, unprotected hosting. A site built and forgotten is the ideal target. After the attack: hidden ads, redirects to suspicious sites, spam from your domain, a site switched off, stolen customer data.
What you lose
Google marks the site “dangerous” and the customer sees the red warning: zero visits. Positions won over years are lost. Emails from the domain end in spam. Foreign clients lose trust. Cleaning costs more than two years of maintenance. And often there is no backup: the site is rebuilt from scratch.
Updates
The system (WordPress or other), the theme, the plugins: security updates every week. Whoever does not update for six months has dozens of known holes. But blind updating breaks the site: it must be done with a backup before and a check after. It is the main job of maintenance.
Backups
Automatic, daily for active sites, stored outside the site’s server (if the server goes down, the backups go too), tested (a backup that does not restore is worthless). With a backup, every problem is solved in an hour; without, in weeks or never.
Security
Strong, unique passwords, two-step verification, restricted login, a firewall, a valid security certificate, a configured security plugin, protected hosting. The “admin/admin” or “admin/1234” login is still on half of Albanian sites.
Monitoring
An automatic check that the site is online (an alert if it goes down), infection scanning, a Search Console check for Google warnings, a speed check, a form check (do emails arrive?). A problem found in an hour costs zero; one found after three months costs the season.
What monthly maintenance includes
Weekly updates with backup and check. Verified backups. Security scanning. Uptime and Search Console monitoring. Small changes (prices, hours, photos, text). A short monthly report. For sites with a booking engine or shop: checking payments and integrations. Cost: a modest monthly fee, far lower than cleaning after an attack.
Static sites as an alternative
For presentation sites (hotels, restaurants, firms, craftsmen), a static site (no management system, no database, no plugins) is almost unhackable, very fast and needs minimal maintenance. Changes are made by the agency. It is the solution we use for most presentation sites: security and speed without high monthly costs.
Hosting
Good hosting in Europe with protection, automatic backups, support. Not the cheapest hosting found online: overloaded, unprotected, unsupported, often with other infected sites on the same server. Domain and hosting in your name, with your access.
Email and domain
Configuring the domain for email (SPF, DKIM, DMARC) so your emails do not end in spam and nobody sends email in your name. Renewing the domain and certificate before expiry: a site that expires “by oversight” loses positions and sometimes the domain.
The checklist
System and plugins updated this month? Yesterday’s backup stored offsite? Strong passwords with two steps? A valid certificate? Search Console without warnings? Does the site open in under three seconds? Does the form send emails? Does the domain expire in more than 60 days? If one answer is “I don’t know”, you need maintenance.
The mistakes
Thinking a published site is finished. Not updating “so as not to break it”. No backups. The same password everywhere. Cheap hosting. The domain in the agency’s or the nephew’s name. Ignoring Google’s emails. Discovering the attack from a customer.
Example: a restaurant in Vlorë
A WordPress site built four years ago, no maintenance. In May, customers report a redirect to a casino site; Google flags the site; the QR menu linked to the site no longer opens. Cleaning: two days, no backup, partial rebuild. The later solution: a static site with the menu, minimal maintenance, monitoring. The cost of maintenance for three years would have been lower than the two days of cleaning and the two weeks lost in season.
Moving from old WordPress to a static site
For many Albanian businesses with an old, unprotected WordPress site, the best solution is not cleaning but rebuilding as a static site: the same content (or better), the same addresses with redirects so positions are not lost, a working form, maximum speed, no plugins to update. The cost compares with cleaning plus two years of WordPress maintenance. For sites with a booking engine, shop or property listings, WordPress or another system remains necessary, with serious maintenance.
Frequently asked questions
What does maintenance cost?
A modest monthly fee; far less than cleaning after an attack.
Does a static site need maintenance?
Minimal: monitoring, renewals, changes made by the agency. No continuous updates.
How do I know if my site is infected?
Search Console, free online scans, strange redirects, customers. A monthly check prevents it.
Can I do maintenance myself?
Updates and backups yes, with discipline; security and monitoring better with someone who does it every day.