FAQ: WordPress and server security engagements, access and pricing

They answer different questions. An audit asks whether WordPress and its operating controls are configured and run safely, and covers breadth: configuration, extensions, accounts, exposure, and recovery. A penetration test asks whether an attacker can exploit defined application behavior, and goes deep on custom functionality, roles, workflows, and APIs. Most sites start with an audit; a penetration test fits when custom code or business logic is the concern.

No. Tooling is used where it improves coverage, but every reported vulnerability is manually reviewed before it appears as a confirmed finding.

There is no single right plugin, and no plugin covers the whole problem. A firewall and malware scanner such as Wordfence supplies useful signals; it does not replace updates, access review, tested backups, or someone reading the alerts. The three free plugins published from this site add a configuration score, a tamper-evident activity log, and fleet alert routing, and are meant to run alongside a scanner rather than instead of one. Anything that runs inside WordPress shares the site’s own permissions, so none of it can see user crontabs, SSH keys, or the rest of the server.

Provide the domain, service or concern, relevant deadlines, business impact, and a non-sensitive environment summary. Do not include passwords, keys, backups, or confidential source code.

Typically $150–$500 for a single site, delivered in 2–4 business days. Multiple sites, WooCommerce or multisite complexity, many roles and integrations, and framework-mapped reporting move it within and beyond that range. The pricing page lists the typical range for every service, and the written proposal states the exact fixed fee before any access is exchanged.

Most single-site cleanups are completed in 1–3 business days, typically for $120–$500 per site. Urgency, the number of infected sites, missing hosting access or logs, and a repeat-reinfection investigation extend it, and those are scoped individually. An active incident receives a reply the same business day.

The written proposal states the fixed fee, the currency, and the payment terms for that engagement before any work or access begins. The published ranges are in US dollars; anything else about payment is set out in the proposal rather than assumed.

Agencies and multi-site owners can request a grouped scope: shared hosting, common components, account separation, reporting, and client ownership are considered when structuring the engagement, and per-site fleet pricing is typically below the single-site ranges. Managed security can run across client sites once it is agreed which party owns client communication, hosting access, updates, remediation approval, and incident escalation. A white-label or rebranded service is not part of the published offering; if you need one, raise it at scoping so the proposal can state what is and is not possible.

Yes, where the host cooperates. Server logs, account isolation on shared hosting, and suspension reviews are often only available from the provider. Anything only the host can change is recorded in the report as a host-owned action rather than silently left out.

Yes, and it is a common reason to ask for an independent audit. Findings are written with evidence another technical team can reproduce, each one names who owns the fix, and remediation can be delivered as guidance for your developer rather than carried out directly. Agreed fixes can then be retested, and the developer’s own access is reviewed like any other account.