This pass covers the specific, well-known hardening steps most sites are missing by default — hiding version numbers, tightening file permissions, disabling XML-RPC where it isn’t needed, and closing off the handful of login-page weaknesses attackers probe automatically. It assumes your site is currently clean; it makes a healthy site harder to break into, it doesn’t clean one that’s already been broken into.
If your site is already showing signs of compromise, read this first
Defaced pages, unfamiliar admin users, a browser warning, or your host flagging malicious files are signs of an active incident, not a hardening gap. This fix closes doors that are currently open; it doesn’t remove someone who’s already inside. If that’s your situation, you need malware removal or forensic cleanup before hardening will do you any good.
Security hardening pass - config, permissions, XML-RPC, login
The standard hardening steps applied to a currently clean site — this closes doors, it doesn't clean up one that's already been broken into.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Confirmation the site is currently clean, with no known active compromise
- WordPress admin access and FTP/file access for the changes involved
- Any existing security plugin already in use, so we work with it rather than against it
This or something else?
| You want the standard set of hardening steps applied to a currently healthy site | This fix covers it |
| Your site is showing signs of an active compromise right now | Outside what this fix does — that’s malware removal, a different specialism entirely |
| You want a specific single step, like just 2FA or just login limiting | A more targeted, cheaper fix — see the individual products below |
| You want a report on what’s outdated, not the fixes applied | Outdated software inventory & upgrade plan |
What we do
- Review current configuration against the standard hardening checklist
- Hide or restrict version and system information visible to visitors
- Tighten file and directory permissions to the minimum needed
- Disable XML-RPC if nothing on your site actually uses it
- Apply login-page hardening (rate limiting groundwork, hiding default error detail)
- Confirm the site still functions normally after every change
What is included
- Every applicable step from the standard hardening checklist
- A written note on which steps were skipped and why, if any were
- Confirmation the site works normally afterward
- The pre-change backup, kept for 30 days
Not included
- Malware removal or cleanup of an already-compromised site
- Firewall (WAF) configuration, a separate, complementary fix
- Two-factor authentication setup, available as its own fix if not already in place
- Ongoing monitoring after this one-time pass
Questions about this fix
How do I know if my site is already compromised before I order this?
Look for content you didn't add, admin users you don't recognize, a browser security warning, or an email from your host about malicious files — any of those means this isn't the right starting point yet.
Will hardening my site now protect against an attack that already happened?
No — hardening closes doors going forward, it doesn't undo or detect something that already got in, which is why we ask you to confirm the site is currently clean before starting.
Does this replace needing a security plugin?
Not entirely — this covers configuration-level hardening that most plugins don't touch, and works alongside a security plugin rather than replacing one.
Will any of these changes break existing functionality?
Some sites do rely on things like XML-RPC for a specific integration, which is why we check what's actually in use before disabling anything, and confirm normal function afterward.
How often should this kind of hardening pass be redone?
It's largely a one-time baseline — what benefits from repeating is monitoring and patching, not re-running the same hardening steps on an unchanged site.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.