Services
WordPress security without drama or guesswork.
Hacked site cleanup, monthly maintenance and preventive security for WordPress sites and stores that depend on the site to sell.
I work with WordPress security and have reported vulnerabilities with public CVE records in plugins. Every service has a fixed scope, a timeline and a deliverable. You know what you get before you pay.
01 / Service
WordPress Emergency
For: a hacked site, redirects, Google spam or downtime.
What it is: triage, containment and cleanup. I identify the vector, remove what was injected and hand back a clean site with what must be done to avoid a repeat.
What's included
- triage and confirmation of compromise
- likely vector identification
- removal of backdoors, malware, suspicious users and plugins
- hardening of the exploited vector
- incident report and prevention checklist
- 7 days of post-cleanup monitoring
What's not included
- data recovery without backups
- Google penalty removal (guidance only)
- feature development or redesign
- a guarantee of immunity (security is a process)
- Timeline
- 24–72h depending on severity.
- Price
- from BRL 900
02 / Service
Monthly WordPress maintenance
For: site, blog or store owners who don't want to get hacked again (ideal right after a cleanup).
What it is: I handle the boring and critical part: updates with backups, monitoring, malware scans and fast response if something happens.
What's included
- WordPress, plugin and theme updates, with a backup first
- verified automatic backups and periodic restore tests
- uptime monitoring and vulnerability alerts for your plugins
- malware scan and checks for suspicious files and users
- basic hardening (access, permissions and headers)
- triage priority if the site gets compromised
- short monthly report
What's not included
- feature development or redesign
- content editing (text, images, products)
- premium plugin or theme licenses (paid by the client)
- a guarantee that the site will never be attacked
- Timeline
- ongoing, month to month.
- Deliverable
- short monthly report.
- Price
- from BRL 150/month
- per site; stores and large sites on request
03 / Service
WordPress Security Review
For: businesses and agencies that want to know what is exposed before it becomes an incident.
What it is: an objective review of the WordPress install answering three questions: what is exposed, what is outdated and what can take the site down or compromise it.
What's included
- WordPress, plugin and theme versions (vulnerable, abandoned, outdated)
- users, roles and permissions
- security headers, backups and hardening
- basic malware signals and suspicious files
- performance and availability risks
What's not included
- full pentest
- load testing
- remediation of every finding (quoted separately)
- Timeline
- 24–48h.
- Deliverable
- 5–8 page report with P1/P2/P3 priorities + 30-min call.
- Price
- from BRL 400
04 / Service
Vulnerability Monitoring for Agencies
For: agencies managing client sites that cannot track plugin CVEs every week.
What it is: I monitor the portfolio, track versions and public vulnerabilities and warn you before the problem becomes an incident.
What's included
- plugin and theme inventory for the portfolio
- version and CVE monitoring
- immediate critical vulnerability alerts
- weekly digest with patch priority
- monthly report
What's not included
- updating the sites (add-on)
- incident response (separate service)
- Timeline
- ongoing.
- Price
- from BRL 400/month
- per agency, up to 10 sites; above that, on request
05 / Service
Plugin or Theme Audit
For: companies building a plugin/theme or reviewing one after a CVE.
What it is: code review focused on real flaws: authorization, nonces, SQLi, XSS, upload, deserialization and access logic.
What's included
- sink and input-flow analysis
- lab testing with proof of concept
- report with file:line, impact and fix
- handover session with the team
What's not included
- infrastructure audit
- server pentest
- Timeline
- 5–10 business days.
- Price
- on request
Next step
Not sure which one fits?
Send me the context (site, stack, what happened) and I'll tell you which service solves it — or if it's not a fit.