A hack doesn’t just take your site down. It takes your reputation.

Days offline. Customers scared off by a malware warning. Weeks winning back Google’s trust. One hack cleanup starts at $490. Keeping hackers out costs less — it comes with our care plan, from $149/mo.

See plans & pricing Contact us

Sound familiar?

You use the same password for WordPress, your host, and your email.
Old admin accounts for people who left years ago.
A security plugin you set up once and never opened again.
Plugin updates you keep meaning to do.
No idea if anyone tried to break in this week.

None of it feels urgent. That’s how sites get hacked. Closing these gaps is our everyday work.

How a small gap turns into a bad month.

An old plugin.

A hacker gets in and makes a secret admin account. What that looks like →

Safety fixes within 2 days. A firewall blocks attacks.
Hidden bad code.

Your site shows spam pages, or sends people to scams. What that looks like →

We scan for it every day.
Google finds it first.

A red warning shows on your site and in search. It can stay for days after the fix.

We get the alert on day one — not your customers.
It reaches your customers.

Card numbers get stolen at checkout, or your emails land in spam. Now you have to tell people.

A firewall, a locked-down login, and daily scans. So it almost never gets this far.

None of this starts loud. So we close the gaps before anyone finds them.

Eight things every WordPress site should have.

The plugin sees the things inside WordPress; the rest sits between WordPress and the world.

Hardening audit

A written review with a fix list ranked by risk.

Firewall configuration

Cloudflare, Wordfence Premium, or Patchstack at the edge.

Login protection

2FA, login throttling, custom login URL, IP allowlisting.

Daily malware scanning

With a same-day alert if anything turns up.

SSL, HSTS, security headers

CSP, X-Frame-Options, Permissions-Policy.

User and role audit

Least privilege, and stale admin accounts removed.

REST API and XML-RPC

Exposure review and lockdown.

Backup verification

Backups that haven't been restored aren't backups.

All of it comes with our care plan, switched on within two days — from $149/mo, month-to-month, first month refundable. If you’re hacked while we look after the site, the cleanup is included. Just need it done once? Send the URL for a fixed price within one business day.

See plans & pricing

A few things we’d bring a specialist in for.

For these you want a credentialed specialist alongside us — we’re happy to make the introduction and handle the technical follow-through.

Compliance — Formal penetration testing for compliance frameworks (SOC 2, ISO 27001, HIPAA)
DDoS — DDoS mitigation beyond Cloudflare's standard tier
Forensics — Forensic investigations for legal proceedings
Privacy law — Privacy and GDPR legal advice (we do the technical implementation only)

Security, specifically.

Is a security plugin enough?

It helps but it's not enough on its own. A typical WordPress hardening engagement also covers: a firewall at the edge, file permissions, wp-config hardening, login URL changes, 2FA, a user and role audit, and security header policy. The plugin sees the things inside WordPress; the rest sits between WordPress and the world.

Do you do penetration testing?

We do offensive-style hardening reviews — checking for the vulnerabilities a real attacker would actually try (outdated plugins, weak admin auth, exposed XML-RPC, REST API leaks, file upload paths, etc). We do not do formal pentests for SOC 2 / ISO 27001 / HIPAA compliance — for that you need a credentialed third-party firm, and we'll happily refer you to one.

What if I'm currently hacked?

Stop here and go to Emergency Help. Recovery first, hardening after. Trying to harden a compromised site usually just locks the attacker in deeper.

Do you do GDPR / cookie compliance?

We configure cookie banners and basic GDPR-required disclosures (privacy page, data export and delete via WordPress core), but we are not lawyers. For regulated industries, work with privacy counsel and use us as the technical implementation arm.

Get a security baseline before you need one.

Hardening costs less than recovery — and on every care plan it’s included. Send your URL for a one-off: we reply within one business day with a concrete recommendation and a fixed quote.