Access and admin surfaces
Roles reviewed, dormant accounts removed, and file-editing routes closed. A file manager plugin left enabled on production is a live attack surface, not a convenience.
rescue & security / specialist delivery
WordPress & WooCommerce hardening.
Hardening for WordPress and WooCommerce estates: access control, plugin risk, WAF and CDN, monitoring, and backups with a restore path you have actually tested.
2015Building production software since
8+ yrsLongest active partnership
100%Source and production visibility
5.0Across 18 verified Clutch reviews
Scope
What this service covers.
Most compromised WordPress sites are not targeted. They are found by a scanner, entered through a plugin nobody updated, and monetised automatically. The defence is unglamorous and it works: control who can reach the admin surfaces, keep the attack surface small, put something in front of the origin, and know within minutes when a thing changes.
Plugin and core risk
What you run, what it is worth to an attacker, and what to remove. The cheapest hardening available is deleting the plugin you stopped using in 2023.
Edge and WAF
Cloudflare in front of the origin, rules that match your actual traffic, and endpoints that return a flat 400 to malformed input rather than a revealing 500.
Monitoring that reaches a human
Malware scanning, uptime, certificate expiry and fatal-error alerting, routed to somebody whose job it is to act on them.
Backups, restored
We prove the restore path rather than trusting the dashboard. A backup nobody has restored is a hope.
Performance failures that read as outages
PHP-FPM exhaustion, caching gone wrong and CDN misbehaviour. Different cause, identical symptom, and just as expensive.
In production
Work from the same practice.
Related delivery with the client context and measurable outcomes attached.
01
Social eventsAn events app with the tools to run it.
Mobile app, backend, advertising tools, a digital marketplace and website.
4+ yrsone team, five codebases
02
TravelTour bookings with a custom mobile-first checkout.
A multilingual website connected to the booking API, with deposits, coupons and affiliate tracking.
90+core web vitals, mobile & desktop
03Professional EnergyEnergy brokerage
One platform for tenders, contracts and accounts.
Supplier tenders, contract management, brokerage accounting and client records.
100+suppliers in one tender
A clear delivery process
From first decision to production.
The same senior team stays close to scope, architecture, build, launch and what comes next.
- 01
Scope & cost
We agree the outcome, users, integrations, budget and main technical risks before the work starts.
- 02
Architecture
We plan the data, interfaces and failure modes around the way the system needs to operate.
- 03
Build & review
You receive source access, a working environment and regular demonstrations throughout delivery.
- 04
Launch & support
We launch, document and monitor the work, then hand it over or continue as your engineering team.
Also in this practice
One team across the whole system.
Related rescue & security capabilities can be commissioned individually or as one connected programme.
Clutch★★★★★5.0 / 5.0Across 18 independently published client reviews
“They have a deeper technical knowledge than any web designer I've met to date.”
Common questions
Planning the work.
01Is this a plugin you install and leave?+
No. Security plugins are part of it, but the work is configuration, access, edge rules and monitoring. A plugin cannot fix an admin account that should not exist.
02Will hardening slow the site down?+
The opposite, usually. Caching, an edge layer and removing unused plugins are performance work as much as security work.
03Can you do this on a site you did not build?+
Yes. Most of it is on inherited estates, which is where the risk usually is.
Start a project
Bring us the exact problem.
Book a 30-minute call with the senior team that will scope and lead the work.