Your Developer Left. Here's How to Secure Everything Before It Gets Worse.

When I joined a digital marketing and branding consultancy as IT Head, I inherited 25 client websites in a state that was genuinely alarming.

The previous developer had been managing everything from personal accounts — some of them belonging to other clients entirely. Domains for one client were purchased using another client's hosting credit. Passwords were scattered across personal emails. The shared server was getting infected by gambling site injections every few days with no fix in sight.

No malice. Just years of a solo developer doing whatever was fastest in the moment, with no handover plan.

I mapped the full scope, fixed everything in one week, and haven't had a single hacking incident since. Here's exactly what I did — and what you should do if you're in a similar situation.

Step 1: Map What You Actually Own

Before touching anything, build a complete inventory:

• Every domain name — who registered it, with which registrar, under which email
• Every hosting account — provider, login email, what sites are on it
• Every website — CMS, version, plugins installed, last updated
• Every third-party service — analytics, email, payment gateways, CDN

This is tedious. Do it anyway. You cannot secure what you haven't mapped.

Step 2: Consolidate Everything Under Company Control

This is the most important step and the one most businesses skip.

Every domain and hosting account should be registered under a company email address that you own and control — not a developer's personal Gmail, not a freelancer's account, not a shared email nobody checks.

If your developer registered your domain under their personal email and you need to recover it, contact the registrar directly with proof of business ownership. Most registrars have a process for this. It takes time but it works.

For hosting, migrate every site to accounts the company controls directly. This also gives you the opportunity to move away from any compromised shared environments.

Step 3: Get Off the Compromised Server

A shared server that keeps getting injected is a shared server where another tenant's site is compromised. You will keep getting infected until you leave.

Move to a clean environment. For most Indonesian SMEs running WordPress sites, this means:

• A reputable hosting provider (Niagahoster, Dewaweb, or international providers like SiteGround or Cloudways)
• Separate hosting accounts for clients whose sites shouldn't share infrastructure
• Fresh WordPress installations — don't migrate the infection

Step 4: Add Cloudflare to Every Domain

Cloudflare sits between the internet and your server. It blocks malicious traffic, hides your server's real IP address, and adds a layer of DDoS protection — all on the free plan.

Setup takes about 20 minutes per domain:

1. Add the domain in Cloudflare
2. Update the nameservers at your registrar to Cloudflare's nameservers
3. Set SSL to "Full (strict)"
4. Enable "Under Attack Mode" temporarily if you're actively being attacked

This alone stops the majority of automated attacks that target Indonesian WordPress sites.

For each WordPress site:

• Install Wordfence Security (free tier is sufficient for most sites)
• Run the initial scan and fix every critical issue it flags
• Change all admin passwords immediately
• Remove any admin users you don't recognize
• Update WordPress core, all themes, and all plugins
• Delete plugins that aren't actively used

One thing Wordfence doesn't fix: weak credentials. If your admin username is "admin" and the password is the company name, that's the first thing an attacker tries. Change both.

Step 5: Set Access Control Before Onboarding the Next Developer

The reason you're in this situation is that a previous developer had unchecked, permanent access to everything. Don't repeat it.

For the next developer:

• Create a dedicated developer account with only the permissions they need
• Never share the master admin password — create separate accounts
• Set a calendar reminder to revoke access when the project ends
• Document which accounts they have access to so you can audit later

This takes 30 minutes to set up properly and saves weeks of cleanup later.

The Full Cleanup Timeline

For 25 sites, this took one week of focused work. For a typical Indonesian SME with 1 to 5 sites:

• Day 1: Inventory and mapping
• Day 2 to 3: Domain and hosting consolidation
• Day 4: Server migration (if needed)
• Day 5: Cloudflare + Wordfence on all sites
• Day 6: Access control audit and documentation

Zero incidents since.