This is a report, not a repair: we scan your site’s plugins, theme, and core files against known vulnerability databases, and hand you back a ranked list of what’s actually exploitable, what’s simply outdated but low-risk, and what to patch first. What you do with the findings, including ordering the actual patches as a separate fix, is up to you.
If the scan turns up evidence of an existing infection, that changes things
A vulnerability scan sometimes surfaces something worse than an unpatched weakness — a webshell, injected code, a file that shouldn’t exist at all. If that happens, we’ll tell you plainly in the report rather than quietly listing it as one more line item, because that’s a different, more urgent problem than a patch schedule can solve.
Vulnerability scan & patch report
A ranked report on what's actually exploitable, not just a list of everything that's outdated.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Read access to the site sufficient to scan plugins, theme, and core files
- Confirmation of any plugins or custom code you already know are outdated
- Your preferred format for the report, if you have one
This or something else?
| You want to know what’s vulnerable and how urgently, without the fixes applied yet | This fix covers it |
| You already have a vulnerability list and want the patches actually applied | A different, remediation-focused fix, priced by the work involved |
| The scan is likely to find an active infection, not just outdated software | We’ll flag that clearly in the report rather than treating it as routine |
| You want a broader inventory of outdated software generally, not vulnerability-specific | Outdated software inventory & upgrade plan |
What we do
- Scan installed plugins, theme, and core files against known vulnerability data
- Rank findings by actual exploitability, not just version age
- Distinguish outdated-but-low-risk from genuinely dangerous
- Check for signs of an existing compromise while scanning
- Compile findings into a clear, prioritised written report
- Flag anything urgent enough to act on before the report is even finished
What is included
- A full vulnerability scan of plugins, theme, and core files
- A ranked, written report distinguishing real risk from routine outdatedness
- Immediate flagging of anything urgent found mid-scan
- A quote for remediation, if you want one
Not included
- Applying the actual patches or fixes — quoted separately based on findings
- Removing malware or cleaning an active infection, a different, urgent specialism
- Ongoing scanning as a ongoing service
- Guaranteeing the scan catches every possible vulnerability, since new ones are discovered continuously
Questions about this fix
What happens if the scan finds an active infection, not just a vulnerability?
We tell you immediately rather than waiting for the full report, since that's a more urgent situation than a patch schedule, and it's not something this report's scope covers fixing.
How is this different from what my security plugin already checks?
Many security plugins do a lighter, automated version of this — this is a deliberate, manually reviewed pass specifically to rank real risk rather than flag every outdated version equally.
Will I need to buy the fixes separately after this report?
Yes, the report itself doesn't include applying patches — we quote that separately once you know exactly what needs doing and can decide what's worth prioritising.
How current is the vulnerability data you check against?
We check against current, actively maintained vulnerability databases at the time of the scan — reasonably current, though new vulnerabilities are disclosed continuously.
Can this replace needing a professional penetration test?
No — this is an automated and manually reviewed vulnerability scan, useful and genuinely informative, but not the same depth as a dedicated penetration test.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.