WordPress Security

& Hardening UK

Yes. We offer emergency malware removal as a standalone service. We'll scan, identify and remove all malicious code, backdoors and injected files. After clean-up, we apply full hardening to prevent re-infection from the same vector. Sites are typically clean within 24–48 hours.

No. All changes are applied to a staging environment first and tested before being pushed to production. We document every change with a rollback plan. Hardening your site removes attack surfaces, not features — your site will look and function identically, just with far fewer vulnerabilities.

If your site handles customer data, processes payments or is business-critical, yes. New vulnerabilities are discovered in WordPress plugins every week. Without monitoring, you're relying on luck. Our monthly Care Plan (from £150/month) includes security scans, vulnerability alerts and malware removal if needed.

No. WordPress core is well-maintained and patched quickly when vulnerabilities are found. The risks come from outdated plugins, poorly configured installations and weak credentials — all of which are entirely preventable with the right setup and ongoing maintenance. The same is true of any CMS.

A one-off security audit is £350 and includes a full vulnerability scan, written report with prioritised findings and a 30-minute debrief call to walk through the results. Security hardening (applying the fixes) is quoted separately based on the number and severity of findings — typically £200–£500. Emergency malware removal for a hacked site is a separate fixed-price service starting from £450.

Two-factor authentication (2FA) requires a second verification step — typically a one-time code from an authenticator app — in addition to a password. For WordPress sites with administrator or editor accounts, 2FA is a critical protection against brute-force attacks and credential stuffing. We configure 2FA for all admin accounts as part of every security hardening project. It takes 10 minutes to set up and significantly reduces your attack surface.

In order of frequency: outdated plugins with known vulnerabilities (the most common cause by far); brute-force attacks against weak or reused passwords; nulled or pirated themes and plugins with backdoors pre-installed; compromised hosting credentials; and cross-site scripting via unsanitised form inputs. The good news is that all five are preventable with correct setup, strong credentials and regular updates.

Yes. After every audit, you receive a written report covering: vulnerability findings (rated Critical / High / Medium / Low), affected component (plugin, theme or configuration), recommended remediation and estimated effort. The report is designed to be presented to a technical team or IT manager — it's specific, actionable and prioritised, not a generic checklist.

We apply a combination of: custom login URL (changing /wp-admin to a non-default path), rate limiting on login attempts, CAPTCHA on the login form, two-factor authentication for all admin accounts, login attempt logging and optional IP allowlisting for clients who access the admin from fixed office IPs. This combination makes brute-force attacks computationally impractical.

XML-RPC is a legacy remote procedure call protocol built into WordPress that allows external applications to interact with your site. It's a common attack vector — used for brute-force amplification attacks, DDoS via pingback and content injection. We disable XML-RPC by default during security hardening unless you specifically use it for a Jetpack integration or mobile app. Disabling it has no effect on normal site function.

Yes. WooCommerce stores have additional security requirements beyond a standard WordPress site. We configure: Stripe or other PCI-compliant payment gateways to prevent card data touching your server; customer data access controls; order management logging; bot protection on checkout pages (to prevent card testing attacks); CAPTCHA on account registration; and regular scans for suspicious order patterns. Card testing — where bots attempt thousands of small transactions to verify stolen card numbers — is a specific threat to WooCommerce stores that requires active monitoring.

Common signs include: Google showing a 'Site may be hacked' warning in search results; Google Search Console flagging security issues; unknown admin user accounts; visitors being redirected to spam sites; your hosting company suspending the account; your IP being blacklisted by email providers; or simply pages looking different. If you're seeing any of these, treat it as a confirmed compromise and act immediately — every hour of delay gives attackers more time to establish persistence.