Checklist to Prepare Your Website for Abliven Shield Security
A clear, action-by-action checklist you can handle or hand to your web person before we install Abliven Shield or Abliven Shield+.
What do I need to do first before Abliven Shield is installed?
Do a full backup and verify you can restore it, and schedule the deployment during a low-traffic window. That gives you a known good copy to return to if anything goes wrong and reduces risk during the setup.
If you prefer we can coordinate the schedule with you so staff know what to expect and customers are notified.
Have you made a full backup and tested a restore?
Start by performing a complete, encrypted backup of your site and immediately test restoring it so you know the copy works and you can return quickly if needed.
NIST recommends a full, encrypted backup at least once a month and to test restores right after backup to ensure they succeed, so treat this as a required step before any security change and keep a copy off-site for extra safety (NIST backup guidance).
Make sure the backup includes your database and media files so the restore returns the full site.
Should I update WordPress core and plugins first?
Update the WordPress core and all active plugins to their latest stable versions before we start so the site is on a supported codebase and we avoid avoidable compatibility issues.
Updating first reduces surprises during the Abliven Shield setup and fixes known bugs and security holes that we would otherwise need to handle in the middle of deployment.
If you are unsure how to update, have PixelGR or your web person apply updates on a staging copy first.
Do I need to remove unused plugins and themes?
Remove any plugins or themes you do not use rather than leaving them inactive, since unused code increases risk.
WordPress Site Health explicitly recommends removing inactive plugins and inactive themes because inactive items are tempting targets for attackers, so cleaning them up is a necessary preparation step (WP Site Health guidance).
Keep only themes you actively use and that receive updates from their authors.
Are my admin accounts and passwords ready?
Confirm which accounts have administrator access and ensure every administrator uses a long, unique password or a password manager.
NIST guidance recommends a minimum password length of fifteen characters for single-factor passwords and also advises allowing passphrases up to at least sixty-four characters, so aim for fifteen characters or longer and allow long passphrases where possible (NIST password length FAQ, NIST SP 800-63B (PDF)).
Consider enabling two-factor authentication for administrative logins where possible and remove any unused admin accounts.
What file permissions should I set?
Set conservative file and folder permissions so the server only gives write access where it is required.
WordPress recommends default Linux permissions of six hundred forty-four for files and seven hundred fifty-five for folders, so set files to six hundred forty-four and directories to seven hundred fifty-five unless your host requires a different setting (WordPress developer handbook).
If your host documents different recommended permissions, follow their guidance and confirm with PixelGR before changing settings.
Should I create a staging copy?
Create a staging copy of the site and run the Abliven Shield setup there first if possible so you can test changes without affecting your live site and catch issues early.
A staging site lets you exercise updates and custom code in the same environment most hosts provide, and it is especially useful if you run a busy local business like a McKinney cafe or a Frisco service shop where downtime hits revenue.
Staging also lets you preview changes on devices and check loading speed without risking customer impact.
How do I check forms and payment integrations?
Test every contact form, booking form and payment flow on the staging site and again on live after deployment.
Submit real but low-impact tests such as a contact message and a $0 authorization or sandbox payment on payment gateways, and confirm email notifications and admin receipts still arrive.
Keep notes or screenshots of any errors during tests to help your web person troubleshoot later.
When should I schedule the deployment?
Plan your installation during a low-traffic window and tell your staff so they expect a short maintenance period.
Pick a time like early mornings on Mondays or a slow weekday afternoon for local retail sites in McKinney, Plano or Allen, and announce the brief window on your social profile or reservation system so customers are not surprised.
Put up a brief maintenance notice so visitors see the planned downtime instead of an error page.
What will PixelGR do during the Abliven Shield setup?
We will install the Abliven Shield module, run an initial scan, enable monitoring and apply safe default rules while working from your staging site when possible.
PixelGR will check the server environment, confirm file permissions, run scans and, if you have Abliven Shield+, configure continuous monitoring and alerting so we see issues early and can act inside the dashboard.
We will provide a short change log describing what we changed and any follow-up actions you should expect.
What should I expect immediately after activation?
You should expect ongoing scans, basic monitoring, and a short handoff explaining how to contact us if something breaks.
After activation PixelGR runs scheduled scans to look for vulnerabilities and misconfigurations. If your site processes card payments we recommend vulnerability scans at least once every three months to meet standard payment security expectations (PCI DSS scanning frequency).
You will receive clear instructions on how to read alerts and how to reach us if something needs attention.
How will PixelGR handle emergencies or critical issues?
PixelGR provides an emergency contact path and, depending on your plan, will take immediate steps to isolate threats and restore service from a verified backup.
We also run drills and incident response exercises at least annually so our response stays practiced and quick, matching recommended testing frequency from NIST guidance (NIST incident response testing (PDF)).
We will contact you promptly and, if needed, restore service from your verified backup while keeping you informed.
What common gotchas should I watch for?
Custom plugins and homegrown theme code are the most common sources of problems after updates, because they can break when core code changes.
To avoid surprises test critical user flows on staging: place a sample order, sign up for a mailing list, submit a booking, and run any integrations like SMS or CRM exports. If any test fails, keep the failing step documented and share it with your PixelGR technician so we can debug fast.
Document custom code authors and plugin vendors so we can contact them quickly if updates break functionality.
Who should handle each step: you or your web person?
Simple items you can do: pick the maintenance window, confirm which email and admin accounts should stay, and run basic contact and payment tests.
Tasks to hand to a web person or PixelGR include taking and verifying encrypted backups, applying updates if you are unsure, setting file permissions to six hundred forty-four and seven hundred fifty-five as recommended, creating a staging site if you do not already have one, and resolving any custom plugin errors found during tests (WordPress developer handbook).
Ask the web person to confirm they can reproduce a successful restore before starting the deployment.
Quick checklist you can copy
- Full encrypted backup and immediate restore test. Keep an off-site copy. (NIST backup guidance)
- Update WordPress core and all active plugins.
- Remove inactive plugins and themes. (WP Site Health guidance)
- Confirm admin list and change weak passwords; use passwords of fifteen characters or more where possible. (NIST password length FAQ)
- Set files to six hundred forty-four and folders to seven hundred fifty-five unless your host requires otherwise. (WordPress developer handbook)
- Create a staging copy and test updates there first.
- Test every form and payment flow on staging and again after deployment.
- Schedule the installation for a low-traffic time and notify staff/customers.
PixelGR is based in McKinney and serves local businesses across Plano, Frisco, Allen, Prosper and the rest of our Texas service area plus small businesses nationwide. If you want, we can run through this checklist with you and your web person before activating Abliven Shield so the launch is smooth and predictable.
Contact PixelGR to schedule a walkthrough of this list so we can handle the technical items while you focus on customers.
Frequently asked questions
How often should I back up my website before installing Abliven Shield?
You should perform a full, encrypted backup at least once a month and test the restore immediately after backing up to ensure the copy works.
Do I need to remove inactive plugins and themes before setup?
Yes, you should remove inactive plugins and themes because they are attractive targets for attackers and increase risk during security changes.
What password length should administrators use?
Administrators should use passwords of fifteen characters or more and the site should allow passphrases up to at least sixty-four characters.
Will PixelGR test payment flows during setup?
Yes, PixelGR will test forms and payment integrations on staging and verify them again on live once Abliven Shield is active.
How often will PixelGR run vulnerability scans after activation?
PixelGR runs regular scans and recommends vulnerability scanning at least once every three months for sites that process card payments to meet standard expectations.
This article was written by ArticlesGR.ai, PixelGR's weekly article service. Want one like it for your business every week? Talk to PixelGR.
Sources
- Changing File Permissions, Advanced Administration Handbook | Developer.WordPress.org developer.wordpress.org
- WP_Site_Health, Class | Developer.WordPress.org developer.wordpress.org
- Frequently asked questions, Digital Identity Guidelines Implementation Resources documentation pages.nist.gov
- Digital Identity Guidelines: Authentication and Lifecycle Management (NIST SP 800-63B) (PDF) nvlpubs.nist.gov
- PCI Security Standards Council, Protect Payment Data with Industry-driven Security Standards, Training, and Programs (FAQ) pcisecuritystandards.org
- Special Publication 800-53, Revision 2, Recommended Security Controls for Federal Information Systems (PDF) nvlpubs.nist.gov
- How to Recover from a Cyber Attack | NIST nist.gov