Independent WordPress & server security
Independent audits, malware removal, and hardening for WordPress and Linux servers — with clear findings, practical fixes, and verified results.
Coverage
A hardened WordPress install can still sit on an exposed server, a weak account model, or a backup nobody has restored. All five layers are assessed together.
DNS, TLS, CDN and WAF — what the public internet reaches, and what it reveals.
Linux, Nginx or Apache, PHP, database, file permissions and tenant isolation.
Core, themes, plugins, and the configuration and update posture around them.
Roles, administrative access, session handling and business logic.
Logging, detection, backups — whether a compromise is noticed and reversible.
Services
Incident “My site is hacked”
Investigation of the likely entry point, removal of every persistence layer, and the hardening that stops the next reinfection.
From $120 per site
— typical range $120–$500, fixed in the written proposal
Most cleanups finish in 1–3 business days
Assess “I need to understand my risks”
A manual review of the site, the store, or the server, delivered as prioritized findings with evidence, remediation, and a retest.
From $150 per site
— servers from $300, penetration tests from $450
Audits take 2–4 business days; penetration tests 5–10
Ongoing “I need ongoing help”
Vulnerability and exposure monitoring, update and configuration discipline, Cloudflare management, and recovery readiness.
From $75 per month
— per site; fleets are scoped individually
Not sure which fits? Describe the system and the concern — scoping decides whether the work is preventive, incident-related, or compliance-driven. Compare all eight services →
Start an enquiry
Active incidents get a reply the same business day; everything else within 24 hours, with the recommended scope and next steps. Scoping and the written proposal are free.
Never send credentials through this website. NDA available · written authorization required before any testing.
The specialist
Independent WordPress and Linux security specialist
I audit, clean up and harden WordPress sites and the Linux servers they run on — every finding validated by hand, never a scanner export.
Public work evidence and credentials →“Guido has been handling our website security and server audits for over five years… He currently helps us keep more than eight servers secure, identifying vulnerabilities, hardening our websites, and addressing potential security issues before they can become serious problems.”
“Guido provided valuable technical support and security expertise throughout a complex server security project… We appreciated the depth of his technical knowledge and the quality of the audit work he delivered.”
“Guido is very reliable, detail-oriented, and really knows what he’s doing when it comes to malware removal. I will definitely hire him again.”
“Great communication. Clear, thorough and fast work. Perfect!”
“Got rid of the malware quickly and professionally. We felt confident having Guido work on our site.”
“Guido is a true professional and an expert in server security. He quickly understood the urgency of our situation, identified the vulnerabilities, and took action with precision and care…”
“Outstanding work — clear communication, careful assessment, helpful suggestions. Already set up another contract with Guido.”
“Very happy with the work here. Very knowledgeable and provided excellent information.”
“10/10 recommendation”
“Project completed successfully, already working on another project.”
“Guido was exceptional from start to finish. He quickly identified the security vulnerability on our WordPress site, cleaned up all compromised files, and implemented the necessary hardening measures…”
“After a fairly sophisticated, multi-pronged attack on our wordpress site, Guido was fantastic at identifying issues, solving them, and helping me build confidence in our web assets again…”
“Second project I’ve done with Guido — again was fast, clear, clean, did great work.”
“5/5. Responds to all inquiries quickly, pricing is very fair and competitive, especially considering the quality of work delivered. Efficient, completing tasks accurately and faster than expected.”
“Je suis entièrement satisfait. Interlocuteur réactif, professionnel et à l’écoute. Je recommande sans hésiter.”
“Die Zusammenarbeit mit Guido war von Anfang bis Ende hervorragend. Er hat sehr schnell gearbeitet, war jederzeit freundlich und professionell und ist auf alle meine Änderungswünsche eingegangen…”
“Guido quickly fixed a malware issue on our website and got our site clean. Very fast and professional. Thanks again.”
“As always, Guido delivers outstanding work. He is proactive, highly experienced, and communicates clearly. We strongly recommend him.”
Every endorsement above is quoted verbatim from a completed contract on the public Upwork profile. An ellipsis marks where a longer review has been shortened; only whole sentences are quoted.
Featured case study · E-commerce
Three parties had cleaned the store, and the malicious behavior returned every time. The fourth engagement treated the recurrence itself as the finding.
Read the repeat-reinfection case study →The deliverable
Each finding carries severity, the affected component, evidence, business impact, a remediation summary, an acceptance test, and a retest status. Scanner output is never reported as a confirmed vulnerability.
View sample reportControlled cross-site read and write between sites sharing one account.
One compromised site can reach the files and configuration secrets of three others.
Move each site into its own hosting account and PHP-FPM identity, with separate deployment and database credentials.
Open — staging migration passed; production separation still outstanding.
Engagement process
Define systems, objectives, exclusions, timing, contacts, and testing permission.
Combine tools with manual validation while respecting the agreed rules of engagement.
Deliver prioritized findings, evidence, business impact, and practical remediation steps.
Fix agreed issues directly or support the client’s team, then verify the result.
Selected research
Wordfence flagged 283 files, ImunifyAV agreed, and the database export was clean. The backdoor was a hidden ELF binary outside the web root on a 261-account WHM server — with the detection method and triage checks for your own server.
Read the WHM server backdoor report →A coordinated infection mapped layer by layer: redacted evidence, IOC triage, MITRE ATT&CK mapping, and the cleanup that held. Free PDF included.
Read the ClickFix incident report →Yes. The inquiry, the scoping conversation, and the written proposal are free and carry no obligation. Fees apply only to the engagement you agree to, at the fixed price the proposal states.
Testing windows and production constraints are agreed first. Nothing destructive runs unless it is separately authorized, and an escalation contact is in place throughout.
It depends. Assessments often begin from the outside with no access at all; audits and hardening need a named, least-privilege account with a documented expiry — arranged after scoping through an agreed secure method, never through this website.
Yes — directly, or as guidance for your own developers and administrators. Agreed fixes are retested and the finding’s status is updated in the report.
Describe your site and concern. I’ll reply within 24 hours with the recommended scope and next steps — the same business day for an active incident. Scoping and the proposal are free; the engagement is quoted as a fixed fee before any access is exchanged.
Or write directly to security@wpserverguard.com
Never send credentials through this website. No passwords, keys, backups, or source code in a first message — if a secret is sent by accident, rotate it immediately. Access, NDA, and authorization terms →