Website Security Hardening Service
A one-time, done-for-you hardening pass on your WordPress site: web application firewall, login and admin lockdown, file and server hardening, and scheduled malware scanning — delivered in 5 business days with a written before/after report.
Harden My Site — $497Not sure yet? Start with the $47 Stack Audit
What gets hardened
Every item below is configured on your actual site, tested, and documented. No generic checklist emailed to you to do yourself.
Firewall & edge protection
- Web application firewall with managed rule set (cloud/CDN-level where your DNS allows, server or plugin-level otherwise)
- Country/bot rate limiting on login and XML-RPC
- Security headers: CSP (report-only to start), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS
Login & account hardening
- Two-factor authentication enforced for every administrator
- Brute-force rate limiting and lockouts
- Default/guessable usernames renamed, unused accounts downgraded, admin count reviewed with you
- Strong-password policy and session expiry
File & server lockdown
- Theme/plugin file editor disabled; file permissions corrected
- PHP execution blocked in
/uploads - Version disclosure removed (generator tags, readme, RSS)
- XML-RPC and unused REST endpoints restricted
- Database prefix and credentials reviewed
Malware scanning & integrity
- Daily malware and core-checksum scan scheduled with alerting to your inbox
- Initial full scan run and any findings cleaned or documented
- Activity logging enabled for logins, plugin and user changes
Hygiene & recovery
- Inactive plugins and themes removed (with your sign-off)
- Abandoned plugins flagged with replacements suggested
- Verified off-server backup taken before and after the work
- One-page incident response sheet: who to call, what to do first
Before / after report
- Scored against the same 50-check framework as the Website Technology Stack Audit
- Every change listed with the reason and how to reverse it
- Residual risks that need a hosting change or a project noted plainly
One flat fee
Single WordPress install, any hosting provider. Additional sites on the same account quoted per site.
- Firewall + security headers configured
- 2FA, rate limiting and account cleanup
- File, server and endpoint lockdown
- Daily malware / integrity scan scheduled
- Pre- and post-work verified backups
- Written before/after report and reversal notes
- 30 days of email support on the changes
Secure checkout via Stripe. Prefer the cart? Add it to your cart instead. We email an intake form for site access within one business day.
How it works
Intake
You complete a short form and share admin, hosting and DNS access. We take a verified backup and run the 50-check baseline audit.
Harden
Firewall, login, file and server changes are applied on staging where available, then production, one domain at a time.
Scan & verify
Full malware and integrity scan, header and login tests, and a second backup once everything is stable.
Report
You receive the before/after scorecard, the change log with reversal steps, and the incident response sheet.
Questions
Will this break my site?
Hardening is applied incrementally with a verified backup before we start and tests after each stage. The CSP header ships in report-only mode so nothing is blocked until you approve it. Every change is documented with how to reverse it.
Which security plugin or firewall do you use?
We work with well-established, actively maintained tools and prefer edge (CDN-level) firewalls where your DNS allows it. If you already pay for a security product, we configure that properly rather than adding another.
My site is already hacked — is this the right service?
Not on its own. Contact us first; active-infection cleanup is quoted separately and the hardening pass follows once the site is clean.
Does it cover WooCommerce or membership sites?
Yes. Payment and login flows are tested after every stage. Sites with custom plugins or heavy integrations may need an extra day; we'll tell you at intake.
Is there anything ongoing?
No. The service is one-time. If you want continuous scanning, alerts and monthly reporting, that is the Website Security Monitoring plan at $97/mo.
Close the gaps before someone finds them
Firewall, login lockdown, file hardening and scheduled scanning — done for you in five business days.
Harden My Site — $497 →