Website cybersecurity

A hacked website loses visitors, trust and its place in Google, often without the owner noticing. This is how we protect the websites we build and run.

How do we protect our own website?

You can check all of this yourself in your browser.

No code from other companies. Everything that runs comes from our own website.
Only approved scripts. A security rule (Content Security Policy) lists every allowed script file. Other code does not run.
No trackers. No analytics tools, ad pixels or tracking cookies.
Encrypted all the way. HTTPS, and the browser is told never to go without it (HSTS).

The work is led by Fawzi Aiboud Nygren, formerly CISO at Volvo Trucks.

Which security risks cost visibility in Google?

Can a plugin or script be hijacked?

Yes. In April 2026, WordPress.org closed 31 plugins where a new owner had added a backdoor. It showed spam to Googlebot only, so the owners noticed nothing.

Can Google penalise a site that was hacked?

Yes. Attackers add spam pages to borrow the site's standing. Google then flags the site, and rankings can stay down after the clean-up.

Can bot protection lock Google out?

Yes, if it is badly configured. The site is then safe but invisible to Google and AI services.

Why is code from other companies a risk?

Every vendor whose code runs on the page is a way in. In Byråindex, 52% of 500 agency sites contact other companies before the visitor has answered the cookie banner. Some outside code is often needed, but it can be reduced and restricted.

Which technical protections do we set up?

What is a honeypot?

A trap that only a bot falls into, such as a hidden form field or a link no person sees. Whatever falls into it is blocked, and the forms stay free of spam without visitors having to solve a captcha.

What do we block?

Traffic that tries to guess passwords, probes for vulnerabilities or sends spam through forms. We check that the blocking never locks out Google or the crawlers of AI services.

Do you protect against DDoS attacks?

No. A denial-of-service attack has to be stopped before the traffic reaches the website, by a service such as Cloudflare. You buy that directly from such a provider.

Is a firewall included?

No, we do not offer a web application firewall (WAF). Honeypots and blocking are part of website maintenance from the Medium tier.

What does a security review include?

We go through your website and tell you what is a real threat and what can wait.

Code from other companies. What loads, what is needed and how the rest is reduced.
Security rules. Content Security Policy, HSTS and other headers.
Updates. Platform and plugins with known vulnerabilities.
Visibility. Security warnings in Google Search Console, and bot protection that lets Google in.
An incident plan. What you do in the first hours.

The price is set in the quote. Ongoing protection is part of website maintenance.

Book a security review

Who handles security in the rest of the organisation?

Our sister brand Robustium, with training for staff and management and support for the NIS2 rules.

Frequently asked questions

Does a hacked website lose its place in Google?

Yes. Google can flag the site for hacked content or show a warning before it, and rankings can stay down even after it has been cleaned.

Are security headers like HSTS a ranking factor?

Not according to what Google has said. HTTPS is a light signal, and we know of nothing showing that security headers affect rankings. They still protect what earns the rankings: visitors' trust and a site free of spam.

What is the difference between Dalanovum and Robustium?

Dalanovum protects the website and its visibility. Robustium works on security across the organisation: training for staff and management and support for the NIS2 rules.

What is a DDoS attack?

A denial-of-service attack in which thousands of computers send so much traffic that the website cannot keep up. It is stopped by a service that receives the traffic before the website, such as Cloudflare.

What is a web application firewall (WAF)?

A filter in front of the website that inspects every request and stops known attack patterns. We do not offer one, but providers such as Cloudflare do.

What is a honeypot?

A trap that only a bot falls into, such as a hidden form field. Whatever falls into it is blocked, and visitors are spared a captcha.