What is actually being attacked
The logs of our servers show it every day: automated requests for configuration files, backup copies and admin interfaces — from senders that have nothing to do with the company behind the site. These are not targeted attacks. They are mass checks. A script knocks on millions of domains for the same weaknesses and reports the hits; only then does someone come by. Whoever does not appear on that list stays invisible to the vast majority of attackers.
The entry points have been the same for years: extensions with a known but unpatched vulnerability, accounts with weak or reused passwords, forms that accept anything, servers on a PHP version without security updates. Online shops add the checkout to the list — manipulated scripts that skim payment data are often noticed only when customers complain.
That is why security at Sharpness does not start with a product, but with an inventory: which versions are running, which extensions are in use and still maintained, who has which access, where configuration and backups are stored. The result is a prioritised list — what must happen now, what is due in the coming weeks, and what you can skip.
Hardening: every system by its own rules
TYPO3, WordPress and Shopware each have their own settings, and we know them from the daily operation of our own and inherited installations. We close what does not need to be open, give accounts only the rights their task requires, review extensions before installation and build payment and checkout processes so that card data never touches your server. For systems on versions without vendor support we plan the update — a security plugin alone does not keep an outdated code base alive.
Beneath that is the server: current PHP and database versions, clean file permissions, configuration and credentials outside the web directory, up-to-date encryption and security headers. On our own servers in Germany this is the standard; on third-party hosting we implement what the environment allows and say clearly where it does not.
Much of what a server would have to fend off never reaches it with us. A firewall in front filters known attack patterns, slows down automated traffic and keeps scanners away — set up so that real customers, payment providers and interfaces pass without obstruction. How we do this with Cloudflare is described on our service page for Cloudflare configuration.
Updates, backups, access: the unspectacular half
Most successful attacks use gaps for which an update has long existed. That is why we install security updates for the core, extensions and server environment promptly — tested, with a way back, at fixed intervals and without you having to think about it. This is the core of our ongoing support, not a by-product.
A backup is only a backup once it can be restored. We store backups separately from the production system, keep several versions and rehearse the restore regularly. When an incident is suspected, this is the decisive question: is there a clean state from before the break-in?
And we clean up access: who can log in where, with which rights — and who left the company long ago. Admin access gets a second factor, credentials get a secure place instead of an email inbox. This is unspectacular work. It still decides the outcome.
When it has happened: a procedure instead of panic
There is no such thing as one hundred percent security, and whoever promises it has not understood it. What does exist is a rehearsed procedure: isolate the system, change access, secure the traces, find the way in, restore a clean state, close the gap. Cleaning up is not done by deleting the files that were found — the back door is usually somewhere else — but with the clean state plus all outstanding updates.
If personal data is or may have been affected, the GDPR adds a duty to notify the supervisory authority within 72 hours (Article 33). We provide the technical basis for that: what happened, since when, which data was reachable, what was done. The legal assessment stays with you or your data protection officer — we make sure the facts are available.