WordPress security hardening. Locked down, still fast.
Reduce the attack surface, enforce the boring best practices that actually stop bots, and keep an eye on the site afterwards. Without turning it into a fortress nobody can use.
Problems I fix.
If two of these are you, I can probably have it sorted this week.
- You've been hacked before and never want that call again
- Admin accounts shared by email, no 2FA, passwords from 2016
- Spam registrations, brute-force logins, card-testing on checkout
- Customer data in WooCommerce or a membership site
- Security plugins stacked on top of each other, site slower than ever
Everything included. Nothing padded.
Least privilege and 2FA
Roles cleaned up, admin accounts minimized, two-factor enforced for everyone who matters.
Firewall and bot mitigation
Cloudflare WAF or equivalent, rate limiting, XML-RPC and login endpoints protected.
Vulnerability scanning
Automated checks for vulnerable or abandoned plugins, with patching before the exploit kits arrive.
File and config hardening
Permissions, disabled file editing, security headers, salts rotated, debug off.
Backups verified
Clean, tested backups so recovery is a restore, not a rebuild.
Incident playbook
If something gets through: isolate, clean, patch, restore, report. Documented and ready.
From access to proof.
You hand over access. I hand back numbers. Snapshot before, rollback ready, no downtime.
- No downtime
- Rollback ready
- Flat price
- 01Day 1
Audit and patch
Vulnerabilities, outdated plugins, weak credentials and misconfigurations found and fixed immediately.
- 02Day 2
Harden and lock
2FA, firewall, permissions, headers, XML-RPC. Tested so nothing you rely on stops working.
- 03Ongoing
Monitor
Threat detection, alerts and monthly reviews through the Care plan.
A typical case: a site hacked through an abandoned slider plugin, with spam pages indexed in Google and a backdoor in the uploads folder. The cleanup removes the malware and backdoors, replaces core and plugin files with clean copies, resets every password and the salts, and asks Google for a review. Hardening follows: 2FA for admins, file editing off, a firewall with rate limits in front of login and checkout, and alerts when files change.
This is for you if
- You've been hacked and want prevention, not another cleanup
- You handle sensitive customer data
- Downtime from attacks costs revenue or reputation
Not a fit if
- A low-risk personal blog (sensible basics are enough)
- You want set-and-forget with no monitoring (security needs eyes on it)
Things people ask before they book.
Do you clean hacked sites?
Yes. Malware removed, backdoors closed, vulnerabilities patched, credentials reset, then hardened so it doesn't come back. Usually 1–2 days, with an incident report.
Will security slow my site?
Not when done properly. A WAF like Cloudflare actually speeds things up through caching. I performance-test before and after.
Monitoring and alerts?
Downtime, suspicious logins, file changes and malware signatures monitored, with alerts by email or chat. Part of the Care plan.
WooCommerce and payment data?
Yes. Gateway integrations secured, rate limiting on checkout against card testing, suspicious order patterns watched.
What's your incident process?
Isolate, assess scope, remove malware, patch, restore clean backups if needed, reset credentials, add hardening, report.
How often do you update defenses?
Continuous monitoring and weekly vulnerability scans. Critical plugin vulnerabilities get patched or mitigated the day they're published.
Team training?
Yes. A short session on phishing, passwords, roles and spotting compromised accounts, included for Care Fleet clients or as a one-off.
How much does it cost?
Hardening from €490, e-commerce €990–1,900, cleanup from €290. Monitoring is part of the Care plan.
Often paired with this.
Got a site, a bug, or an idea? Send it over.
You'll get a flat price and a start date today. No pitch deck, no discovery phase.