Security assessment
Review of WordPress users, plugins, themes, versions, access paths, backup coverage, and common exposure points.
WordPress security and recovery
Reduce avoidable risk and know how the site will be recovered.
WordPress security is an operating practice, not a badge. WPGeared reviews access, updates, backups, exposed services, plugin risk, malware indicators, and recovery readiness, then documents the work and remaining responsibilities.
Good fit
When this service makes sense
- A site showing redirects, spam pages, warnings, or unknown users
- A business site with no tested backup or recovery process
- A WordPress installation with long-overdue updates
- A team that needs a practical hardening and maintenance plan
Scope
What the engagement covers
Malware investigation
Inspection of suspicious files, database content, injected users, redirects, and indicators of compromise when cleanup is requested.
Hardening work
Least-privilege access, update planning, login protections, file and configuration changes, and monitoring appropriate to the environment.
Recovery notes
A record of changes, known constraints, recommended follow-up, and the backup or rollback path used during the engagement.
Delivery
A visible process from review to handoff
- 01
Contain
For active incidents, we first limit further damage and preserve a recovery path.
- 02
Investigate
We review the site and environment to identify likely entry points and affected areas.
- 03
Clean and harden
Approved repairs and controls are implemented with current backups and functional checks.
- 04
Document
You receive changes made, remaining risks, and recommended ownership for ongoing maintenance.
Engagement options
Clear starting points, confirmed scope
Published prices are in USD and describe a starting scope. Your brief is reviewed before work, access, timing, and final price are confirmed in writing.
Security review and hardening
From $199
For a functioning site that needs a structured risk review and prioritized improvements.
- Access and software review
- Backup verification
- Agreed hardening work
- Findings and follow-up notes
Incident cleanup
Quoted after triage
For suspected or confirmed malware, injected content, redirects, or compromised access.
- Initial triage
- Containment plan
- Cleanup scope
- Post-cleanup recommendations
Before you book
Important boundaries
- No provider can guarantee that a website will never be compromised. Security work reduces risk and improves detection and recovery.
- Cleanup does not include unrelated redesign, hosting remediation, reputation recovery, or third-party account work unless included in writing.
- Active incidents may require cooperation from the host, domain registrar, email provider, payment processor, or other account owners.
Questions
What clients ask first
Should I send passwords in the project form?
No. Send only the site URL and symptoms. Access should be shared later through an agreed secure method using temporary accounts where possible.
Can a cleaned site be infected again?
Yes, if the entry point, vulnerable software, stolen credentials, or compromised hosting environment remains. Cleanup includes follow-up recommendations but cannot control every external system.
Do you take the site offline?
Only when containment requires it and after discussing the impact when circumstances allow. The safest response depends on the incident.
Next step