Security Hardening & Verification
A defined list of measures, applied to your site and then verified one by one. You receive a report that shows what was changed, how it was tested, and what is still open.
Who this is for
- Sites that were just cleaned and should not be the easy target again.
- Businesses that need to show a client, partner or auditor that specific measures are in place.
- Developers who built the site and want a second, security-focused pair of eyes on the configuration.
Security Hardening & Verification
Standalone hardening for one site. Combined with a cleanup: €390 for both, instead of €520.
What's included
- Baseline review of the current configuration: access control, file permissions, exposed files and directories, outdated components, admin surface.
- Hardening measures applied with you or by us, depending on your preference: admin access restrictions, file and directory permissions, disabling unused entry points (XML-RPC, file editors, unused REST endpoints), secure configuration of PHP and the web server where we have access, security headers, backup hygiene.
- Removal of exposed artefacts: backups in the web root, leftover installers, debug and log files, stale staging copies.
- Verification of every measure after it is applied, from inside and from outside the server.
- Written verification report with a pass / partial / open status per measure.
What's not included
- Malware cleanup. If the site is currently infected, start with Malware Removal, or take the combined Cleanup + Hardening at €390.
- Code review of custom application logic or plugin source code. That is quoted separately.
- Rewriting or replacing components. We tell you which ones are a risk; replacing them is your decision.
- A penetration test. Hardening closes known weak points; it is not an attack simulation.
How we work
Hardening without verification is a list of good intentions. Every measure here is tested after it is applied.
Baselineday 1
We review the current state and send you the list of proposed measures. You remove anything that conflicts with how the site must work.
Applydays 1–2
Measures are applied one by one. Changes that could affect functionality are made with you available, with a backup of each file we touch.
Verify
Each measure is tested: does the restriction actually hold, from outside the server, as an anonymous visitor and as a logged-in user.
Reporttypically 2–4 business days total
Verification report with the status of every measure and the exact evidence of the test. Open items are listed with what would close them.
What you receive
- Verification report: measure, what was changed, how it was tested, status.
- List of open items with the reason they stayed open (usually a functional dependency) and a recommendation.
- Backups of every configuration file we changed.
What changes the price
- Combined with Malware Removal: €390 in total.
- Server-level hardening (firewall, services, system users, antivirus): see Server Security & Remediation.
- Several sites with the same stack on one server: quoted per site at a reduced rate.
Frequently asked questions
Will hardening break my site?
Some measures can affect functionality, for example restricting XML-RPC breaks certain mobile apps and integrations. That is why we send the list first, apply changes with a backup, and test every one. If something must stay open for a business reason, it is marked "open" in the report with the reason.
Is this the same as installing a security plugin?
No. A plugin adds a layer inside the application. Hardening changes the configuration of the site, the PHP runtime and the web server where we have access, and removes exposed material that a plugin cannot see. We do not sell or install security products; if you already use one, we work alongside it.
Can I do the changes myself and have you only verify them?
Yes. Several clients prefer that their own developer applies the measures. We provide the list with acceptance criteria, then verify and report. The price is the same.
What does "verification" mean in practice?
For each measure there is a concrete test. Example: "wp-config.php is not readable from the web" is verified by requesting it as an anonymous visitor and recording the response. The report contains that evidence, not just a checkmark.
Do you harden the server too?
Only the parts we can reach from the site account unless you add Server Security & Remediation, which covers the operating system, services, firewall, user accounts and server antivirus.
Does hardening replace monitoring?
No. Hardening reduces the attack surface today; monitoring tells you when something changes tomorrow. The Maintenance plans include a quarterly hardening review.
Related reading
From our research notes
Want the measures and the proof?
Tell us about the site and its stack. We reply with the proposed measure list and the next steps.