WordPress Security Audit

This package audits a WordPress or WooCommerce site for the weaknesses attackers actually use: outdated or abandoned plugins, weak admin accounts, open XML-RPC and REST endpoints, loose file permissions and settings left at their defaults. You get a report that ranks each finding, explains the fix, and a retest once it is done.

Where WordPress sites get caught

• Plugins and themes compared with public vulnerability databases, plus plugins that no longer receive updates.
• Admin and editor accounts, leftover agency logins, password rules and whether two-factor sign-in exists.
• xmlrpc.php, the REST users endpoint that lists usernames, directory listing and debug logs visible to visitors.
• wp-config.php placement and permissions, file editing in the dashboard, and salts that were never changed.

Business adds WooCommerce: whether a customer can view someone else's order, how coupons and checkout fields handle odd input, and what your payment plugin exposes. Premium reads one custom plugin's code and tests a backup restore on a staging copy.

Access and permission

You sign a short authorization that confirms the site is yours. Managed WordPress hosts such as WP Engine or Kinsta have their own security testing rules, so I work inside them and favor a staging copy, which most of those hosts create in one click. I need an admin login and SFTP or hosting panel access; I do not need to export your customer or order data, and I do not.

If the site is already hacked

Spam pages, unknown admin users or injected scripts mean the site is compromised, and an audit is the wrong tool. I stop, show you what I found and keep the evidence. Malware cleanup is a separate website care package; the audit can follow once the site is clean. For building or rebuilding WordPress sites, see WordPress services.