Hardening, scanning, same-day cleanup
WordPress Security: Hardening, Scanning and Same-Day Cleanup
Scan any WordPress site for the exposures attackers actually use — version disclosure, user enumeration, open XML-RPC, missing headers, outdated plugins with known CVEs. Then we harden it and watch it. 500+ hacked sites recovered and 150+ malware removals, on WordPress only.
WordPress sites are compromised through outdated plugins, weak or reused admin passwords and exposed login endpoints — not through WordPress core. Hardening closes those routes; daily scanning catches what gets through; cleanup removes it and shuts the door behind it.
Scan your site for exposure
Version disclosure, username leaks, missing security headers and response time, checked from outside.
Reads only what any visitor can see — no login, no access needed. We keep the address, your email and what the check found for 1 year, then delete it. How we handle it.
- Scan reads only what any visitor can see — no access needed, nothing stored
- Hardening applied the same day, not filed as a recommendation
- Daily malware scanning with cleanup included from $79/month
- Blacklist clearance with Google and the host handled for you
Every hardening measure, and what it closes
| Measure | What it closes | Applied |
|---|---|---|
| Login rate limiting and lockout | Brute force and credential stuffing | Day one |
| Two-factor on all admin accounts | Reused and leaked passwords | Day one |
| Unique login URL | Automated bots hitting /wp-login.php | Day one |
| XML-RPC disabled | Amplified brute force and pingback abuse | Day one |
| User enumeration blocked | Attackers harvesting valid usernames | Day one |
| Version disclosure removed | Targeting by known core or plugin CVE | Day one |
| File permissions corrected | Privilege escalation after a partial breach | Day one |
| File editing disabled in admin | A stolen session writing PHP | Day one |
| Security headers set | Clickjacking, MIME sniffing, mixed content | Day one |
| Daily malware scan | Backdoors and injected redirects | Ongoing |
| Plugin CVE watch | Known vulnerabilities before they are exploited | Ongoing |
| Off-site backups | Ransomware and destructive cleanup | Ongoing |
What the scanner checks, and what it cannot
The scan above is the same first pass we run before quoting. It fetches the site as any visitor would and reports what the site volunteers about itself:
- Version disclosure — whether the WordPress version is readable from the page source, the generator tag or
/readme.html. - User enumeration — whether
?author=1or the REST users endpoint hands out valid usernames. - Login exposure — whether
wp-login.phpsits at the default path with no rate limiting. - XML-RPC — whether it answers, which turns one brute-force request into hundreds.
- Security headers — which of the standard set are missing.
- Server response time — because a slow origin is both a ranking problem and a sign of something running that should not be.
It reads only what is public. It cannot see inside your files or database, so it will not find a backdoor — that needs access, and it is the first thing we do on a paid audit.
Hardening is a day-one job, not a recommendation
Most security audits end in a PDF of things the client should do. Every measure in the table above is applied by us, in the first week, on every site we take on. The list is not long and none of it is exotic. It is unglamorous work that almost nobody does, which is why it keeps working.
Compromised right now
Do not delete anything yet — the files are how we find the way in, and deleting them without closing the route means it happens again. Take the site to maintenance mode if you can, change the hosting password, and use the emergency route rather than the contact form. Cleanup itself, including the entry route and blacklist clearance, is WordPress malware removal; the attack types it deals with are catalogued under WordPress security threats.
Hardening on its own is a plugin purchase. What separates it from a service is who watches the scan output and who patches on the day a disclosure lands — the trade-off is worked through in a security plugin versus a managed service, and the tier where each measure appears is on maintenance plans and pricing.
The attacks this stops
- Vulnerable pluginsThe single largest route in. A plugin with a public CVE and no update applied is scanned for within hours of disclosure.
- Brute force on wp-loginAutomated, constant, and cheap for the attacker. Rate limiting and a unique login URL make it pointless.
- Pharma and SEO spam injectionHidden links and cloaked pages that only show to Googlebot. You find out when rankings collapse.
- PHP backdoorsA single file left behind after a breach that lets them back in after you have cleaned everything else.
- Malicious redirectsMobile visitors sent to a scam page while desktop looks fine, so the site owner never sees it.
- Compromised admin accountsA stolen or reused password. No amount of file scanning finds a legitimate login being misused.
What happens after you report it
- You report it, or the scan finds itDowntime and active compromise skip the window entirely and are answered at any hour, nights and weekends included. Everything else begins inside your plan's support window, in business hours — 24 hours on Professional, 8 on Business.
- The site is taken to a safe stateWe snapshot it as-is for evidence, then restore service — usually from a clean backup while cleanup runs in parallel.
- CleanupInjected files removed, core and plugin files compared against known good copies, database scanned for injected content and rogue admin users.
- The way in is closedCleanup without this is a reinfection in a fortnight. We find the entry route and shut it, then rotate every credential.
- Blacklist clearanceReview requests with Google Safe Browsing and the host, and we chase them until the warning is gone.
- Written upWhat happened, how they got in, what changed. You get the document whether or not you stay with us.
Plans that include this
- Starter$39/monthor $390 a year — two months freeBlogs, portfolios and brochure sites
- UpdatesMonthly
- BackupsWeekly, 30-day retention
- Uptime5-minute checks
- Malware removalNot included
- Most chosenProfessional$79/monthor $790 a year — two months freeSmall businesses and lead-generation sites
- UpdatesWeekly + PHP version management
- BackupsDaily, 60-day retention
- Uptime1-minute checks
- Malware removalIncluded
- Business$149/monthor $1490 a year — two months freeStores, membership sites, anywhere downtime costs money
- UpdatesWeekly, tested on staging first
- BackupsDaily, 90-day, multi-location
- Uptime1-minute + 2-hour restore
- Malware removalIncluded
The service that covers this
wordpress maintenance plugin vs serviceDecide between a WordPress maintenance plugin and a managed service by what each one does when an update breaks the site at two in the morning.…
Related pages
Questions people ask before calling
How do WordPress sites actually get hacked?
Overwhelmingly through outdated plugins with published vulnerabilities, then weak or reused admin passwords. WordPress core itself is rarely the route in.
My host says the site is clean. Is it?
Host scanners look for known file signatures. They routinely miss database-injected spam and single-file backdoors. The scanner above checks what is exposed, which is a different question.
How long does cleanup take?
Most cleanups are done the same day. A site with several months of undetected infection, or one already blacklisted, can take two to three days including the review request.
Is malware removal included or charged extra?
Included on Professional and Business ($79 and $149 a month). Business covers unlimited hack recovery.
Can you stop it happening again?
Cleanup that does not find the entry route is a reinfection waiting to happen, so finding it is part of the job. After that it is the hardening table above, plus keeping plugins patched.
Will I lose search rankings?
If the site was blacklisted or serving cloaked spam, there is usually a dip. Recovery is normally weeks once the warning is cleared and the spam is gone.