Security audit
Review of themes, plugins, users, configuration and server setup, with a report of risks ordered by severity.
Security Hardening & Audits Secure by design,
Secure by design,
not by luck.
WordPress is safe when it's built and configured carefully. I review your code, plugins and server setup, close the gaps, and leave your site harder to break into.
Security
Fewer doors, stronger locks
Most WordPress breaches don’t come from WordPress core — they come from vulnerable plugins, custom code without proper checks, weak logins and loose server configuration. I look at all of it with a developer’s eye and fix the causes, not just the symptoms.
A good fit if you
- Handle leads, customer data or members through your website
- Run custom themes or plugins that have never had a security review
- Need to meet a client, agency or compliance security checklist
- Get spam, brute-force attempts or suspicious activity on your site
- Have been hacked before and want to make sure it doesn't happen again
What's included
Code review
Custom code checked for missing sanitization, escaping, nonces and capability checks — the root of most WordPress vulnerabilities.
Login & access
Stronger authentication, sensible user roles, brute-force protection and limits on who can do what in wp-admin.
Security headers
Content Security Policy, HSTS and related headers tuned to protect visitors without breaking your site.
Hardened forms
Contact and lead forms protected against spam, injection and abuse, with data handled safely.
Secure files & media
Private documents and downloads served only to the right people, with uploads locked down against malicious files.
How we work
Assess
Read-only review of your site, code and configuration. Nothing changes until you've seen the findings.
Report
A clear, prioritized report in plain language: what the risk is, how likely it is, and how to fix it.
Harden
Fixes applied on staging first, then deployed carefully so security improvements don't break functionality.
Keep it safe
Recommendations for updates, backups and monitoring — or ongoing protection as part of a maintenance plan.
Tools & practices
- WordPress Coding Standards
- OWASP Top 10
- Content Security Policy
- HSTS
- Nonces
- Capability checks
- Sucuri
- WAF
- SSL/TLS
- 2FA
- Least privilege
- Backups
Frequently asked questions
Isn't a security plugin enough?
Security plugins are useful, but they can't fix insecure custom code, a vulnerable plugin you depend on, or a weak server setup. An audit finds the issues a plugin can't see.
My site has been hacked. Can you help?
Yes. The priority is to contain the damage, find how the attacker got in, clean the site and close that door so it doesn't happen again. Get in touch as soon as possible.
Will hardening break anything?
Changes like security headers can affect third-party scripts, so everything is tested on staging first and rolled out carefully, with your key features checked after each step.
Can you review a plugin or theme before we install it?
Yes. I can review third-party or custom code before it goes live and tell you whether it's safe to use or what needs to change.
Do you offer ongoing security monitoring?
Yes, as part of my maintenance plans: regular updates, backups, monitoring and a developer who already knows your site if something goes wrong.
Let's talk Secure your
Secure your
site
Tell me about your site and any concerns you have. If you're dealing with an active incident, say so in your message. I reply within 24 hours.