WordPress application security
Configuration reviews, extension exposure, authentication, custom workflows, malware persistence, recovery readiness, and controlled remediation.
Author and security specialist
G. Schad — WordPress and Linux Security Specialist
G. Schad is the independent specialist behind WP Server Guard. For over nine years, his work has connected WordPress application security with Linux web-server hardening, Cloudflare security management, malware response, and authorized security testing. In the past 12 months alone, G. Schad has personally cleaned more than 150 compromised WordPress sites — a record that can be verified during scoping.
Never send credentials, private keys, backup archives, or confidential source code through this website.
Professional focus
Security work grounded in the system that is actually running
G. Schad works across the boundary between WordPress, the Linux host, the web server, PHP, databases, identity, Cloudflare, logging, and recovery. That full-stack view is important because a WordPress symptom can begin with a vulnerable extension, a stolen administrator session, an unsafe server account, or a persistence mechanism outside the application directory.
Assessments emphasize written authorization, manual validation, least-privilege access, evidence that another technical team can reproduce, and retesting after agreed fixes. Public examples are sanitized where client confidentiality requires it.
Linux and web-server security
Account access, SSH, Nginx or Apache, PHP isolation, file permissions, patching, logging, backups, and hardening priorities.
Cloudflare security management
Operational security work for website fleets where DNS, TLS, WAF, access controls, traffic behavior, and change discipline must remain consistent.
Evidence-led reporting
Validated findings, clear ownership, practical remediation guidance, sanitized evidence, and explicit retest status rather than raw scanner output.
Selected portfolio
Public project evidence on Upwork
These links open the original portfolio entries so project claims remain connected to their public source. Client names and confidential production details are not reproduced here.
Cloudflare · Multi-site security
Cloudflare Security Management for 130+ Websites
A public portfolio entry covering security management for a fleet of more than 130 websites. Review the source entry for the available client context and platform-hosted project evidence.
Review the Cloudflare security management projectSecurity audit · E-commerce
Security Audit for German Online Jewelry Store
A public portfolio entry for a security audit in an online retail environment. Review the source entry for the available audit context and platform-hosted evidence.
Review the online jewelry store security auditTestimonials
Endorsements from past clients
Client feedback on G. Schad’s work across website security, server audits, WordPress support, and PHP troubleshooting. Each endorsement comes from a completed Upwork contract and can be matched to the public profile linked above.
Guido has been handling our website security and server audits for over five years, and his work has been consistently reliable and thorough. He currently helps us keep more than eight servers secure, identifying vulnerabilities, hardening our websites, and addressing potential security issues before they can become serious problems. His knowledge of WordPress security, malware prevention, server security, and practical hardening measures has been invaluable to us. Guido is responsive, detail-oriented, and someone we have trusted with the security of our infrastructure for many years. I would highly recommend him to anyone looking for an experienced and dependable website security specialist.
I hired Guido S. to fix our WordPress (Error 500). Guido was fast and reliable. He knew directly what to do. We will continue to work with him.
I had the pleasure of working with Guido and I couldn’t be more satisfied. He was diligent in addressing several critical issues, and his approach was strategic and comprehensive — he kept me informed at each stage, explaining the work done in a clear way. The results exceeded my expectations, and the issues we had with Google Search Console and PHP were resolved efficiently. He is an expert in his field and I would highly recommend his services.
Scroll horizontally to read all verified client endorsements.
Professional certifications
Professional certifications held by G. Schad
G. Schad holds eight professional certifications spanning penetration testing, Linux administration, enterprise security, cybersecurity, and data analysis. Together, they support the practical security work presented across this site.
CompTIA
CompTIA PenTest+
- Issued
- October 2025
CompTIA
CompTIA Linux+
- Issued
- September 2025
CompTIA
CompTIA Security+
- Issued
- Date not published
Offensive Security
Offensive Security Certified Professional (OSCP)
- Issued
- August 2025
IBM
Data Analysis with Python
- Issued
- February 2024
Google · Coursera
Google Advanced Data Analytics Certificate
- Issued
- February 2024
Google Cybersecurity Certificate
- Issued
- January 2024
- Credential ID
- ZVT8FJAV9F5F
CompTIA
CompTIA Advanced Security Practitioner (CASP+)
- Issued
- December 2023
Public development profile
GitHub and WordPress security plugins
G. Schad is the author of WordPress security plugins that turn audit and incident-response experience into practical tools for site owners and agencies. The official WordPress.org directory lists Lockora Security Audit, Who Changed It? – Activity Log & Audit Trail, and WPSecureOps Connector under the author name Guido Schad.
WPSecureOps Connector is approved, listed, and available for download in the official WordPress.org Plugin Directory. It forwards completed Wordfence scan findings to a WPSecureOps dashboard so teams can triage security alerts across multiple sites.
The guidos-wpserverguard GitHub account provides a stable development identity. Client code, credentials, confidential assessments, and production evidence are never published in public repositories.
WordPress.org · Current
Lockora Security Audit
A WordPress security-posture plugin covering hardening checks, core integrity, public exposure, update posture, vulnerability matching, scan history, WP-CLI reporting, and optional AI-assisted client reports.
Read about Lockora Security Audit and install itWordPress.org · Current
Who Changed It? – Activity Log & Audit Trail
A self-hosted activity log with searchable events, field-level diffs, severity classification, alerts, privacy controls, exports, and a tamper-evident hash chain.
View Who Changed It? on WordPress.orgWordPress.org · Current
WPSecureOps Connector
A lightweight connector that forwards completed Wordfence scan findings to a WPSecureOps dashboard, helping teams triage security alerts across every WordPress site they manage.
View WPSecureOps Connector on WordPress.org