01
WordPress Security Audit
Find exploitable weaknesses, unsafe configuration, exposed information, and operational gaps before attackers do.
See what a WordPress security audit includes →Independent WordPress & Server Security
Independent WordPress Security: Audits, Malware Removal, and Server Hardening
Independent security audits, hardening, malware remediation, and authorized penetration testing for WordPress websites and Linux web servers.
NDA available
Written authorization required for testing
Never send credentials through this website
- 9
- YEARS
- 200+
- ENGAGEMENTS
- 4.8/5
- RATING
- CompTIA
- CERTIFIED
What gets assessed
- 01DNS / TLSASSESS
- 02CDN / WAFASSESS
- 03LINUX / NGINX / APACHEHARDEN
- 04PHP / DATABASEHARDEN
- 05WORDPRESS / PLUGINS / THEMESASSESS
- 06USERS / AUTH / BUSINESS LOGICVERIFY
HIGH
Administrative endpoint exposed without adequate access controls
- IMPACT
- Increases probability and impact of credential attacks.
- FIX
- Restrict admin access, enforce phishing-resistant MFA, add rate controls.
- RETEST
- Pending
The difference
Security does not stop at the plugin layer.
A secure WordPress configuration can still sit on an exposed server, weak account model, unsafe deployment process, or incomplete recovery plan. WP Server Guard examines how the complete system is configured, accessed, updated, monitored, and restored.
-
01
External attack surface
What is reachable from the public internet, and what it reveals.
-
02
WordPress application and extensions
Core, themes, plugins, and the configuration around them.
-
03
Authentication and authorization
Accounts, roles, administrative access, and session handling.
-
04
Server, PHP, database, and file isolation
The runtime beneath the site, and the boundaries between tenants.
-
05
Detection, backups, recovery, and operational controls
Whether a compromise would be noticed, and how quickly it is reversible.
Services
Seven defined engagements, each with a concrete deliverable.
02
WooCommerce Security Audit
Review checkout and payment flow, customer accounts and data, extensions, and store business logic as one commercial system.
See the WooCommerce security audit scope →
03
Malware Cleanup & Hardening
Remove malicious persistence, investigate the likely entry point, and close the conditions that allowed reinfection.
Review our WordPress malware cleanup process →
04
Web Server Security Audit
Review Linux, Apache/Nginx, PHP, TLS, permissions, account isolation, logging, backups, and administrative access.
See what the Linux server audit covers →
05
Web Application Penetration Test
Test defined application functionality under written authorization and receive evidence-led findings with remediation guidance.
Compare a security audit with penetration testing →
06
Cloudflare Security Management
Configure DNS, TLS, WAF rules, and origin protection so the edge actually protects the origin — proven across a 130+ site fleet.
See the Cloudflare security service scope →
07
Ongoing Security Care
Monitor vulnerability exposure, updates, configuration drift, and recovery readiness after the initial engagement.
Review managed WordPress security coverage →Not sure which one you need?
Describe the system and the concern. Scoping determines whether the work is preventive, incident-related, or compliance-driven.
Request a Confidential AssessmentEngagement process
Controlled from scoping to retest.
-
STEP 01
Scope and authorize
Define systems, objectives, exclusions, timing, contacts, and testing permission.
-
STEP 02
Assess and verify
Combine tools with manual validation while respecting the agreed rules of engagement.
-
STEP 03
Report and explain
Deliver prioritized findings, evidence, business impact, and practical remediation steps.
-
STEP 04
Remediate and retest
Fix agreed issues directly or support the client's team, then verify the result.
The deliverable
Findings your team can act on.
Each finding carries severity, the affected component, sanitized evidence, business impact, a remediation summary, and a retest status. Scanner output is never reported as a confirmed vulnerability.
Review the redacted security report
FINDING WP-04 · SANITIZED EXTRACT
2 of 17
Administrative endpoint exposed without adequate access controls
EVIDENCE
Sanitized request/response sequence included in the report.
BUSINESS IMPACT
Increases the probability and potential impact of credential attacks.
REMEDIATION
Restrict administrative access, enforce phishing-resistant MFA, and implement rate controls and alerting.
RETEST
Pending
Proof
Independent specialist. Verifiable history.
Additional verification, including certification checks and a legal contracting identity, is provided during scoping.
PUBLIC WORK HISTORY
4.8/ 5
200+ engagements alone in the past 2 years. Public profile and credential verification are provided during scoping.
Meet G. Schad and review public work evidence →CASE STUDY · E-COMMERCE
Repeat reinfection stopped after entry point was closed
Three cleanups by others had not held. Persistence was removed, the likely initial-access path identified, and access rotated.
Read the WordPress reinfection case study →CASE STUDY · MEMBERSHIP SITE
Server audit before an insurer questionnaire
Host, SSH, PHP isolation, and backup restoration were reviewed and documented, then retested after remediation.
Read the server security review case study →Research & guides
Published work you can read before hiring anyone.
Real investigations and practical symptom guides, sanitized for public reading — free, with no email, form, or account required.
INCIDENT REPORT · 30+ SITES
ClickFix malware across a WordPress fleet
A coordinated infection mapped layer by layer: redacted evidence, IOC triage, MITRE ATT&CK mapping, and the cleanup that held. Free PDF included.
Read the ClickFix incident report →GUIDES · HACKED-SITE SYMPTOMS
Start from the symptom you are seeing
Fake verification pages, spam redirects, Japanese search results, “Deceptive site ahead” warnings, unknown admin users, repeat reinfections — what each means and what actually fixes it.
Browse all security guides →FREE DOWNLOAD · CHECKLIST
The WordPress security audit checklist
The control areas a real audit reviews — configuration, accounts, plugins, hosting, recovery — as a checklist you can run against your own site. HTML and PDF.
Get the audit checklist →Client voice
Trusted with the same infrastructure for years.
“Guido has been handling our website security and server audits for over five years, and his work has been consistently reliable and thorough. He currently helps us keep more than eight servers secure, identifying vulnerabilities, hardening our websites, and addressing potential security issues before they can become serious problems. […] I would highly recommend him to anyone looking for an experienced and dependable website security specialist.”
Confidentiality
Sensitive work requires controlled access.
Initial inquiries should contain no passwords, private keys, backup archives, or confidential source code. Access is arranged after scoping through temporary, least-privilege accounts and an agreed secure exchange method. Access should be removed when the engagement is complete.
NOTE
Never send credentials through this website. If a secret is submitted by accident, rotate it immediately without waiting for confirmation.
- NDA available
- Signed before scoping if you prefer.
- Temporary access preferred
- Named, least-privilege, with a documented expiry.
- No credentials by email or form
- An agreed secure exchange method is used instead.
- Written authorization
- Required before any active testing begins.
- Defined testing windows
- Agreed timing plus emergency contacts on both sides.
- Secure deletion terms
- Retention agreed per engagement, then evidence destroyed.
Common questions
Is this an automated scan?
No. Tooling is used where it helps with coverage, but every reported issue is validated by hand before it appears in the report. Scanner output is never reported as a confirmed vulnerability.
Will testing affect production availability?
Production constraints and testing windows are agreed before any active testing. No destructive testing is performed unless it is separately and explicitly authorized, and a defined escalation contact is in place for the duration of the engagement.
What access will you need?
It depends on the engagement. Assessments often begin from the outside with no access at all; audits and hardening usually need a named, least-privilege account with a documented expiry. Access is arranged after scoping through an agreed secure exchange method — never through this website, email, or a form.
Can you fix the findings as well as report them?
Yes. Remediation can be carried out directly, or delivered as guidance for your own developers and system administrators. Agreed fixes are retested afterwards and the finding's retest status is updated in the report.
Start with a confidential assessment request.
Describe the system, concern, and desired outcome. Do not include credentials or sensitive files. You will receive a reply with the next scoping step.
Or write directly to security@wpserverguard.com