WordPress Security
A practical security review of your WordPress installation, hosting, plugins, user accounts and access controls, followed by the work needed to reduce avoidable risks.
Fixed-fee WordPress security packages from £395.
Most website security work is preventative. We cannot promise that a website will never be compromised. What we can do is remove unnecessary weaknesses, strengthen access and configuration, and make sure suitable backups are available if something goes wrong.
Hardening or hacked-site recovery? Choose security hardening when the website is currently operating and you want preventative work. If you are seeing malware, unauthorised access, redirects or website failure, use Emergency Support instead.
Not sure which route is appropriate? We can advise before work begins.
Website security is easier to improve before an active incident occurs. Outdated software, weak access controls, unnecessary administrator accounts, poor configuration and unreliable backups can all create avoidable risk.
We review the areas most likely to cause problems and put practical safeguards in place. The aim is not to claim that a website can never be compromised. It is to reduce the likelihood that common attacks succeed, limit the potential impact, and make recovery more reliable if something does go wrong.
You will receive a clear summary of what was checked, what was changed and any further work we recommend.
Practical, risk-focused approach
Reduce risk and limit impact
Clear reporting and next steps
The right service depends on whether your website is operating normally or showing signs of an active security incident.
Site operating normally
Use this service when the website is currently working and you want to reduce avoidable security risks.
Signs of an active incident
Use this service when the website may already have been compromised or important functionality has failed.
Tell us what is happening and we will advise before any work begins.
Each package includes a structured review of the areas most likely to affect your website's security and recovery readiness. The depth of the review and the configuration work completed will depend on the package and the complexity of the website.
A review of WordPress core, plugins, themes, hosting, user accounts and the security measures currently in place.
Appropriate firewall settings to reduce malicious traffic, automated attacks and common WordPress exploits.
Scanning of website files and the database for suspicious code, backdoors, spam injections, unexpected changes and other indicators of compromise.
A review of administrator accounts, user permissions, login protection and any access that is no longer required.
A check of backup frequency, storage, retention and the options available for restoring the website following an incident.
Package-specific configuration work, followed by a clear report explaining what was checked, what was changed, any remaining risks and our recommendations.
If the review identifies malware, unauthorised access or other evidence of an active security incident, we will explain what has been found and confirm the appropriate recovery work before continuing. Malware removal and hacked-site recovery are not included within the fixed-fee security packages.
The right package depends on the size of the website, its functionality, the number of users and integrations, and how heavily your business relies on it. We will review the details provided and confirm the appropriate package before work begins.
Standard
£395fixed fee
Typical fit: Fewer than 20 plugins, standard hosting, a small number of user accounts, and no ecommerce or membership functionality.
Advanced
£595fixed fee
Typical fit: A larger plugin ecosystem, custom functionality, multiple administrator accounts, several integrations, or greater business reliance on the website.
Business Critical
Business Critical
From £995
Typical fit: WooCommerce stores, booking systems, learning platforms, membership websites and customer portals.
Standard and Advanced are fixed-fee packages for websites matching the typical scope shown above. Business Critical reviews start from £995. We will review the website's size, functionality, hosting and integrations, then confirm the package and total fixed fee before work begins.
A clear, fixed-fee process to identify risks, strengthen your website and give you complete clarity.
Send us the website address, hosting provider, what the website does and any security concerns you have.
Please do not send passwords or other sensitive access details through the enquiry form.
We review the website's size, functionality, hosting setup and access requirements before recommending the appropriate package.
We then confirm the fixed fee, what is included and the access we will need before any work begins.
We complete the audit, scanning and security configuration work included within the agreed package.
We address the identified risks covered by the package and document anything that requires further investigation, additional work or a separate decision.
You receive a straightforward report explaining what we checked, what we changed, any remaining concerns and the actions we recommend next.
Where relevant, we will also explain whether ongoing monitoring, maintenance or development support would be beneficial.
Frequently asked questions
Answers to common questions about choosing a security review package, how the work is carried out and what happens next.
The appropriate package depends on the size of your website, how it is hosted, the functionality it includes and the level of review required.
Send us the website address and a brief explanation of what the website does. We will review the details and recommend the appropriate fixed-fee package before any work begins.
Each package includes a defined combination of security checks, scanning, configuration review and website hardening.
We will confirm exactly what is included before the review begins. You will also receive a clear report explaining what we checked, what we changed and whether any further action is recommended.
Where appropriate, we may make agreed security improvements directly to the live website.
We take care to minimise disruption and will explain any change that carries additional risk or requires a separate decision. Where a staging environment is available and suitable, some work may be completed there first.
If we find malware or evidence that the website has been compromised, we will explain what we have found and recommend the appropriate next step.
Malware removal and incident recovery are not automatically included within a standard security review. Depending on the severity and urgency of the problem, we may recommend Emergency Website Support before the review can continue.
No security provider can guarantee that a website will never be compromised.
The purpose of the review is to identify known risks, improve the website's security configuration and reduce the likelihood and potential impact of an attack. Continued protection also depends on secure hosting, regular updates, monitoring, backups and responsible access management.
The timescale depends on the package, website size, functionality and how quickly the required access can be provided.
We will confirm the expected timescale before work begins. Most reviews are completed within an agreed working window rather than requiring the website to be taken offline.
We will normally need access to the WordPress administration area and may also require hosting, server, database or security-platform access.
The access required depends on the package and the website setup. We will confirm what is needed and explain how to provide it securely. Please do not send passwords through the enquiry form.
No. A security review is a one-off service that assesses and strengthens the website at a specific point in time.
It does not include ongoing updates, monitoring, backups or continued security management. These services are available through our monthly WordPress Support Plans.
You will receive a straightforward report explaining what was checked, what was changed, any remaining concerns and the actions we recommend next.
Where further work is needed, we will explain whether it can be handled as a separate development task, through Emergency Website Support or as part of an ongoing WordPress Support Plan. No additional work will be completed without your approval.
Yes. The review can include WooCommerce websites, including sites with customer accounts, checkout functionality and third-party payment integrations.
Because ecommerce websites often handle more sensitive information and have additional functionality, they may require a more detailed package. We will review the website before confirming the appropriate scope and fixed fee.
Tell us what the website does, how it is hosted and whether you have any current security concerns. We will review the details and recommend the appropriate fixed-fee package.
If there are signs that the website has already been compromised, we will explain whether Emergency Website Support is the more appropriate route.
