A WordPress security service checks a WordPress site the way an attacker would look at it, then fixes what it finds. Ours covers the plugin and theme inventory, user accounts and roles, server and file permissions, two-factor sign-in, tested backups, malware removal when the site is already infected, and alerts that tell you when something changes. You receive a hardened site and a report written for the owner, with the technical detail in an appendix.

Where WordPress sites are weakest

The weak points of a WordPress site usually sit in what surrounds the core: plugins, themes, accounts and hosting. The core itself is maintained by the WordPress project, which has shipped automatic core updates since version 3.7.

The common problems we check for:

  • plugins and themes with known vulnerabilities, or abandoned by their authors;
  • unused plugins left installed and still reachable from the internet;
  • admin accounts shared between people, former staff still listed, no two-factor sign-in;
  • writable core directories, exposed wp-config.php, debug output switched on in production;
  • backups stored on the same server as the site, never tested by a restore.

OWASP lists software supply chain failures as a separate category in its Top 10:2025, and for a typical WordPress site the plugin list is that supply chain.

WordPress hardening: what we change

Hardening means removing what the site does not need and locking down what stays. The WordPress hardening guide sets the baseline: keep core and plugins updated, delete plugins you do not use, keep file permissions as tight as the site allows, enable two-step authentication and back up the database and files regularly.

Measure What it means for your site Source
Current core version Older versions are not maintained with security updates WordPress hardening guide
Plugin and theme updates Auto-updates can be enabled per plugin and per theme since WordPress 5.5 WordPress auto-updates documentation
Remove unused plugins Every installed plugin is code that can be attacked, active or not WordPress hardening guide
File permissions Plugin files writable only by your user account; wp-config.php readable only by you and the web server WordPress hardening guide
Two-step sign-in An extra factor for every administrator WordPress hardening guide
Regular backups Database and full installation, stored in a trusted separate location WordPress hardening guide

On top of that baseline we set roles by the least privilege each person needs, limit or protect the login and XML-RPC endpoints where the site does not use them, configure security headers, and put the site behind a firewall or CDN where it makes sense. Each change is tested on a copy first.

WordPress security audit

The audit is a structured check of one site with a written result. It covers the WordPress install, every plugin and theme, user accounts, the hosting panel, the server configuration that the site depends on, TLS and headers, forms and uploads, and the backup process.

Custom code gets a manual review of the parts that accept input, handle uploads, call external services and check permissions. For a WooCommerce shop the payment page and its scripts get special attention; the rules for those are on our page about PCI DSS 6.4.3 and 11.6.1 for online stores.

When the site is already hacked

A hacked WordPress site is cleaned first and hardened second, and the entry point is found in between. We copy files, database and logs before removing anything, compare core, plugin and theme files with official copies, and look for web shells, rogue administrators, injected options and scheduled tasks.

Keys and salts in wp-config.php are regenerated so existing sessions end. All passwords are changed. The detailed process, including the Google review request, is on hacked website repair.

What you receive

The engagement ends with documents and a changed site.

  • The audit report: findings with their severity and what to fix today, this month or later, plus a short plain-language version for the owner.
  • The plugin and theme register: version, author status, known issues, keep or remove.
  • The completed hardening list, each measure marked done or deliberately skipped with the reason.
  • Two-factor sign-in on every administrator account.
  • A backup verified by a test restore.
  • Alerts for file changes, new administrators and failed updates, routed to the people you name.
  • A re-check that confirms each fixed finding is closed.

What we need from you

We need administrator access to WordPress, access to the hosting panel or server, a staging copy or permission to create one, and a contact who can approve changes. The scope letter lists the sites, the work allowed on each and the dates.

Boundaries

The service covers your WordPress site and the hosting it runs on. A plugin vendor's own code is fixed by that vendor; when a plugin has a known hole and no fix, we propose a replacement or a temporary block. Penetration testing of the site is available on request as a separate engagement. The goal is to close the known routes and notice changes quickly. A provider that promises an unbreakable site is overstating what security work can do.

Risks of patching it yourself or with a freelancer

Installing three security plugins and calling the job done is a frequent shortcut, and it adds code to update without closing the original hole. Another frequent one: enabling all auto-updates with no tested backup, so the first broken update takes the shop offline.

A chatbot can list generic hardening steps but cannot see which of your plugins are abandoned or what the server logs show. A freelancer paid per task rarely re-checks the site afterwards. Our work runs under a contract with a fixed scope, every finding is checked by a person, and the re-check is part of the job.

Who does the work

Contracts for security work are signed with INNOVA CONSULT LTD., Ottawa, Ontario (Corporation Number 1522612, Corporations Canada). We run more than 80 websites of our own under daily vulnerability checks. Client data is covered by a confidentiality agreement, and the report is yours.

Cost

A fixed price is set in the scope letter after a 30-minute call; it depends on the number of sites, plugins and custom code, and on whether the site is already infected.

Related services

Sources (checked 2026-10-23)

Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.