Cyber security · Malware removal · Speed optimisation
Website security and performance are two sides of the same coin: a slow site loses visitors, an unprotected site loses their trust, and very often both problems share the same root cause. Since 2015, AMS.AL has protected business websites and online stores with web application firewalls, DDoS protection through a CDN, malware scanning and removal, SSL certificates and backups that are actually tested. At the same time we make those sites faster, measuring every change against Google's Core Web Vitals, so that the improvement is real and not just a feeling.
2015
Experience since 2015
Websites, servers and online stores protected and maintained since 2015
≤ 2.5 s
LCP we aim for
Google's 'good' threshold for loading the main content
≤ 200 ms
INP we aim for
Google's 'good' threshold for how quickly a page responds to input
HTTPS
SSL and HSTS
Encrypted connections on every page, with HSTS to prevent a fall back to HTTP
Many businesses think about security only after their site has been hacked, and about speed only when someone complains that the site crawls on a phone. By then the work has become an emergency: the site is offline or flagged, Google shows a warning, customers are calling and nobody knows where to start. An emergency like that always costs more than prevention would have.
Website security and performance are more closely linked than they look. An outdated plugin is both an open door for attackers and a source of heavy code that slows down every page. A bot trying thousands of passwords a minute does not only threaten the administrator account; it also overloads the server for real visitors. A well configured CDN brings content closer to each visitor and, at the same time, filters harmful traffic before it ever reaches your server.
The table below compares the usual approach, where things get fixed after they break, with the way we handle website security and performance at AMS.AL. It is not a project that ends once; it is a clear, measured and documented routine.
| Criterion | The usual approach | Website Security and Performance with AMS.AL |
|---|---|---|
| Protection from attacks | A security plugin installed once and forgotten, with no rules for suspicious traffic. | A web application firewall (WAF) and DDoS protection through a CDN such as Cloudflare, with rules tailored to your site. |
| Malware | Discovered when Google shows a warning or when the host suspends the account. | Regular scanning of files and the database, removal of malicious code and closing the weakness that let it in. |
| Updates | Done rarely, directly on the live site, with no backup and no testing. | Planned updates, tried first in a staging environment, with a backup taken before every change. |
| Speed | Oversized images, no caching and dozens of scripts loaded on every page. | Caching at several levels, a CDN, WebP or AVIF images and unnecessary code removed, all measured with Core Web Vitals. |
| Backups | Copies kept on the same server and never tested to see whether they restore. | Copies stored away from the main server, with regular restore tests and several days of history. |
| Monitoring | The customer notices the problem before the technical team does. | Monitoring of uptime, the SSL certificate, file changes and speed, with automatic alerts. |
A visitor never sees the firewall and does not know what a cache is, but they feel the result immediately. A site that opens quickly, shows no browser warnings and never redirects to strange advertising earns trust, and that trust turns into enquiries, calls and orders. That is why website security and performance are not only technical matters; they are part of how your business presents itself online.
If your site does not exist yet or you are planning a rebuild, our web development service prepares it from the start with clean code, optimised images and security rules, so you do not have to bolt them on later.
Every site has different risks and bottlenecks. A brochure site with modest traffic mainly needs updates and backups, while an online store taking payments needs broader protection and speed even at its busiest hours. So we split website security and performance into four areas and choose, for each site, what it really needs.
A web application firewall (WAF) sits in front of your site and inspects every incoming request. It blocks known SQL injection attempts, malicious scripts, bots guessing passwords and scanners looking for vulnerable plugins. We configure it through a CDN such as Cloudflare, so that harmful traffic is stopped before it reaches the server.
For DDoS attacks, where thousands of devices send requests at once to knock a site offline, the CDN's network absorbs most of the load. We add rate limits on sensitive pages such as the admin login, forms and checkout, so a flood of requests does not stop your business.
Best for: Online stores, sites with contact forms and any business that receives traffic from campaigns.
When a site has been compromised, the signs are often small: redirects to unknown pages, administrator accounts nobody created, new files in odd folders, or emails landing in spam. We scan the site, compare its files with the original versions and find the code that was added.
The clean-up does not end with removing code. We find how the attacker got in, close that weakness, rotate passwords and keys and, if Google or the browsers have flagged the site as dangerous, request a review once it is clean. Finally you receive a clear written report of what happened.
Best for: Sites that have been hacked, show warnings or behave strangely.
Hardening means taking away as many opportunities from an attacker as possible. For WordPress that includes removing unused plugins and themes, limiting user rights, protecting configuration files, disabling code editing from the dashboard and enabling two-factor authentication (2FA) for every administrator.
On the server we configure SSL/TLS with modern protocol versions, enable HSTS and add security headers such as Content-Security-Policy, X-Frame-Options and Referrer-Policy. These rules tell the browser how to protect the visitor even when someone tries to abuse the site.
Best for: WordPress and WooCommerce sites that would rather prevent attacks than clean them up.
Speed is measured, not guessed. We start with a PageSpeed audit and real-user data from Search Console, find what slows the site down and fix it in order of impact: page and object caching, the CDN, compressing images to WebP or AVIF, lazy-loading images below the fold and removing scripts that are not needed.
When the database is the bottleneck, we clear out old data, add missing indexes and optimise the heaviest queries. For high-traffic sites we also work on the server, together with our web hosting service, so that the time to first byte is as short as possible.
Best for: Sites that load slowly on phones, stores with large catalogues and sites that depend on Google.
Good website security and performance work does not start with changes; it starts with measurement. We need to know where the site stands before we touch anything, so that at the end we can show clearly what improved. That is why we split the work into six steps, each with deliverables you receive.
We check the versions of WordPress, plugins and PHP, user rights, the SSL certificate, security headers and existing backups. We scan the site for malware and measure its speed with PageSpeed Insights and Search Console data, on mobile and desktop.
What you receive
Based on the audit we prepare a plan with the order of work: the biggest risks first, then the changes with the most impact on speed. Before we touch anything, we take a full backup and store it away from the server.
What you receive
If we find malware, we remove it and close the weakness. Then we update the core, plugins and theme in a controlled way, remove what is not used, enable two-factor authentication for administrators and configure security headers and HSTS.
What you receive
We place the site behind a CDN such as Cloudflare, configure the web application firewall, bot rules and limits for the admin login and forms. After every rule we check that payments, forms and customer accounts still work normally.
What you receive
We configure caching, compression and the CDN for static files, convert images to WebP or AVIF at the right sizes, defer scripts that are not needed straight away and optimise the database. After each change we measure again, to see the real effect.
What you receive
Finally, the website security and performance of your site move into our ongoing monitoring: uptime, the SSL certificate, unexpected file changes, backups and Core Web Vitals are checked automatically. We test restoring from backup periodically and send you a short report in plain language.
What you receive
Website security and performance come with plenty of technical terms, but the core ideas are simple. Here is what we explain to every client before we start, so decisions are made with full information.
Google measures pages with three indicators that describe the visitor's experience. Largest Contentful Paint (LCP) measures how fast the main content appears, Interaction to Next Paint (INP) measures how quickly the page reacts when someone clicks or types, and Cumulative Layout Shift (CLS) measures how much elements jump around while the page loads. The thresholds Google calls 'good' are clear:
Most hacked sites are not hand-picked targets. They are sites with an outdated plugin that an automated bot finds while scanning thousands of addresses an hour. Regular updates close most of those doors, and they often make the site faster too, because newer versions of PHP and plugins run more efficiently.
The only risk of updating is that a new version breaks something. So we never update directly on the live site without a backup, and we try major changes in a staging environment first.
An SSL/TLS certificate encrypts the connection between the visitor and the site, so passwords and form data cannot be read on the way. HSTS tells the browser to always open the site over HTTPS, even when someone types the address without it. Security headers add another layer: they limit where scripts may load from, stop the site from being framed inside other pages and control what information is passed on when a visitor follows a link.
A backup on the same server as the site disappears with it, and a backup that has never been tested may turn out to be incomplete exactly when you need it. We follow the 3-2-1 rule: three copies, in two different places, one of them away from the main server.
If your site collects names, emails or orders, protecting them is also a legal duty under the GDPR and Albania's personal data protection law. For card payments, card data should be processed by a licensed payment provider under the PCI DSS standard rather than stored on your site. We configure the site to keep no more data than it needs, because website security and performance include respect for your customers' information.
We do not promise a particular PageSpeed score, because the result depends on the theme, the plugins and the content you choose. What we do is measure before and after, aim for Google's 'good' thresholds and show you clearly what changed and why.
Monitoring checks the site from the outside, as a visitor would, and from the inside, by looking at files and the server. That way we see not only whether the site is online but also whether anything has changed without your knowledge.
Periodically we send you a short report in plain language: what was updated, how many attempts were blocked, how Core Web Vitals moved and what we recommend next. When the site has Search Console, we connect speed data with search data, so you can see whether the technical improvement is also helping your visibility.
Speed is only one part of ranking on Google. If you want to work on content, keywords and site structure too, our SEO services build on the same measurements.
A site cleaned today can be at risk tomorrow if a new vulnerability appears in a plugin it uses. That is why website security and performance work best as an ongoing service rather than a one-off fix. For content updates, plugin checks and small changes, our website maintenance service works from the same monitoring.
To make the choice easier, we have grouped our website security and performance work into three levels. Each one is adapted to your site, and you can start with a one-off audit and move to ongoing protection later. Use the finder below to see which level is closest to your needs.
A full check and a clean site, once.
Best for: Sites that want to know where they stand, or that have been hacked and need cleaning.
Ongoing protection and a site that loads quickly.
Best for: Business sites and small online stores that want peace of mind and fast loading.
Full care for sites where every minute counts.
Best for: High-traffic online stores, platforms with user accounts and web applications.
Choose what describes your site and we will show you the closest level. It is only a guide; the quote is prepared after the audit.
Choose at least one option to see the recommendation.
We do not publish fixed prices, because the work depends on the state of the site, its technology and its traffic. After the audit we prepare a free, no-obligation quote with every cost clearly listed.
These are the questions businesses ask us most often before trusting us with the security and speed of their site. If yours is not here, write to us and we will answer personally.
It includes protecting the site with a WAF and DDoS protection through a CDN, malware scanning and removal, hardening WordPress and the server, SSL/TLS with HSTS, security headers, two-factor authentication, backups with restore tests and monitoring.
On the speed side it includes caching, the CDN, image optimisation to WebP or AVIF, cleaning up code and the database, and measurement with Core Web Vitals.
Write or call us straight away and do not delete anything, because the affected files help us find how the attacker got in. We start by isolating the site and taking a copy of its current state, then clean it, close the weakness and change the passwords.
The total time depends on the size of the site and how deep the attack went; we tell you clearly after the first check.
No, and we suggest being careful with anyone who does. The PageSpeed score changes from one test to the next and depends on the theme, plugins, ads and content. We aim for Google's 'good' thresholds for LCP, INP and CLS, measure before and after, and show you the real results.
For most businesses, yes. A CDN brings content closer to visitors, reduces the load on the server and offers DDoS protection and a web application firewall. We configure it so that it does not break the checkout, customer accounts or forms.
Not when they are configured well. Often the opposite happens: blocking harmful bots lowers the server load, and removing unnecessary plugins makes the site lighter. That is why we handle website security and performance together and measure speed after every new rule.
Security updates should be applied as soon as possible after release, while major updates should be tried in a staging environment first. In the ongoing plans we check them regularly and apply them with a backup before every change.
Backups are stored away from the server the site runs on, with several days of history. We test restoring periodically, so we know it works. If you need to go back, we restore the whole site or only part of it, such as the database.
Yes. Most sites that come to us for security and speed were built by someone else. We start with the audit to understand how the site was built, and tell you openly whether something can be fixed or whether a rebuild makes more sense.
Because since 2015 we have built websites and managed servers, domains and email under one roof. When a problem affects the code, the server and the CDN at once, you do not need three suppliers blaming each other.
We speak openly about what we can and cannot promise, and we measure our work with clear indicators. You can read more about our story and the way we work on our About Us page.
Send us your site's address and tell us what worries you most: a recent attack, slow loading on phones, or simply wanting to sleep easy. We will reply with a short check, a website security and performance plan and a free quote, with no obligation.
You can email us or call us directly. If your site is under attack right now, call: a quick response limits the damage.
Last updated: