Services
WordPress security without drama or guesswork.
Start with the free diagnosis. If you need cleanup, maintenance or a deeper look, scope and price stay clear before any payment.
I work with WordPress security and have reported vulnerabilities with public CVE records in plugins. Every service has a fixed scope, a timeline and a deliverable. You know what you get before you pay.
Start here
Free diagnosis or full diagnosis?
Both exist. The difference is what I can see and whether I need access.
| Free | Full | |
|---|---|---|
| What is included | Public signals: Google spam, Safe Browsing, visible redirects or injected content, public WordPress/plugin versions, SSL and security headers. | File and database scan, logs, entry point and a detailed prioritized report. |
| Access needed | No password. Just the domain, with your authorization, on a site you own. | Needs access (WP admin and/or hosting), agreed beforehand. |
| Deliverable | Short written summary plus a quick WhatsApp chat or call about the next step. | 5 to 8 page report with P1/P2/P3 priorities plus a 30-min call. |
| Price | Free | from BRL 400 |
The free check is not a cleanup. It shows what is visible from the outside and whether it makes sense to go further.
01 / Service
WordPress Emergency
For: a hacked site, redirects, Google spam or downtime.
What it is: triage, containment and cleanup. I identify the vector, remove what was injected and hand back a clean site with what must be done to avoid a repeat.
What's included
- triage and confirmation of compromise
- likely vector identification
- removal of backdoors, malware, suspicious users and plugins
- hardening of the exploited vector
- incident report and prevention checklist
- 7 days of post-cleanup monitoring
What's not included
- data recovery without backups
- Google penalty removal (guidance only)
- feature development or redesign
- a guarantee of immunity (security is a process)
- Timeline
- 24–72h depending on severity.
- Price
- from BRL 900
02 / Service
Monthly WordPress maintenance
For: site, blog or store owners who don't want to get hacked again (ideal right after a cleanup).
What it is: I handle the boring and critical part: updates with backups, monitoring, malware scans and fast response if something happens.
What's included
- WordPress, plugin and theme updates, with a backup first
- verified automatic backups and periodic restore tests
- uptime monitoring and vulnerability alerts for your plugins
- malware scan and checks for suspicious files and users
- basic hardening (access, permissions and headers)
- triage priority if the site gets compromised
- short monthly report
What's not included
- feature development or redesign
- content editing (text, images, products)
- premium plugin or theme licenses (paid by the client)
- a guarantee that the site will never be attacked
- Timeline
- ongoing, month to month.
- Deliverable
- short monthly report.
- Price
- from BRL 150/month
- per site; stores and large sites on request
03 / Service
Free diagnosis
For: site owners or agencies that want a quick outside read without sharing a password.
What it is: an external check, only with your authorization, on a site you own. No password and no access. I look at public signals and send you a short summary.
What's included
- spam or strange pages indexed in Google
- Google Safe Browsing and public blacklist warnings
- visible redirects or injected content
- publicly visible WordPress or plugin version exposure
- SSL and basic security headers
- short written summary plus a quick WhatsApp chat or call about the next step
What's not included
- file or database scanning (that is the full diagnosis)
- malware cleanup
- admin or hosting access
- Timeline
- usually the same business day.
- Deliverable
- short written summary plus a quick chat about the next step.
- Price
- Free
04 / Service
Full diagnosis
For: businesses and agencies that need to go deep: what is exposed inside, the entry point and what to prioritize.
What it is: a review with WordPress access (and hosting if needed) answering what is exposed, what is outdated and what can take the site down or compromise it.
What's included
- file and database scan
- log and user analysis
- entry point identification when evidence allows
- WordPress, plugin and theme versions (vulnerable, abandoned, outdated)
- security headers, backups and hardening
- detailed report with P1/P2/P3 priorities
What's not included
- full pentest
- load testing
- remediation of every finding (quoted separately)
- Timeline
- 24–48h.
- Deliverable
- 5 to 8 page report with P1/P2/P3 priorities plus a 30-min call.
- Price
- from BRL 400
05 / Service
Vulnerability Monitoring for Agencies
For: agencies managing client sites that cannot track plugin CVEs every week.
What it is: I monitor the portfolio, track versions and public vulnerabilities and warn you before the problem becomes an incident.
What's included
- plugin and theme inventory for the portfolio
- version and CVE monitoring
- immediate critical vulnerability alerts
- weekly digest with patch priority
- monthly report
What's not included
- updating the sites (add-on)
- incident response (separate service)
- Timeline
- ongoing.
- Price
- from BRL 400/month
- per agency, up to 10 sites; above that, on request
06 / Service
Plugin or Theme Audit
For: companies building a plugin/theme or reviewing one after a CVE.
What it is: code review focused on real flaws: authorization, nonces, SQLi, XSS, upload, deserialization and access logic.
What's included
- sink and input-flow analysis
- lab testing with proof of concept
- report with file:line, impact and fix
- handover session with the team
What's not included
- infrastructure audit
- server pentest
- Timeline
- 5–10 business days.
- Price
- on request
Next step
Not sure which one fits?
Send me the context (site, stack, what happened) and I'll tell you which service solves it, or if it's not a fit.