Sites that stay up, stay fast and stay yours.
Hardening, audits and incident response for WordPress and WooCommerce, from an engineer who works on WordPress security at scale and spoke about search-endpoint DDoS at WordCamp Europe 2026.
- Free 30-min call
- No obligation
- Reply within 1 business day
A good fit if
Sound familiar?
“The site goes down under traffic you can’t see, and the host says everything looks fine.”
“You’ve been hacked, cleaned up, and hacked again.”
“A security questionnaire from a customer or insurer landed and nobody knows the answers.”
“Pages take four seconds on mobile and the SEO agency keeps sending the same report.”
What I do
The work
Security audit
Plugins, users, configuration, hosting, backups and the application layer reviewed against what attackers actually do to WordPress. A written report with a prioritized fix list, in plain language.
Hardening
WAF rules, rate limiting on search, login and REST endpoints, least-privilege roles, secrets handling, update policy, monitoring and alerting.
Incident response
Containment, forensics, clean rebuild from known-good code, and the fix for the way in. Then the controls that stop the repeat.
Performance
Core Web Vitals on real devices: caching strategy, database and query tuning, image and font pipeline, third-party script diet. Load tested before a launch or a sale.
Ongoing care
Monthly updates, uptime and security monitoring, and a person who answers when something looks wrong.
How it works
From first call to shipped work
Audit, one week
Access to a staging copy and read-only hosting access. You get the report and the fix list with prices, whether or not you hire me to fix it.
Fix, in priority order
Critical items first, usually within days. The rest scheduled in a low-risk window with rollbacks ready.
Keep it that way
Monitoring, alerts and a short runbook. Optional monthly care if you want someone on it.
Audits take one week; incident response starts the same day. Fixed price for defined work, hourly for ongoing engineering. How I work with US teams.
Proof
“Samuel was an excellent developer to work with and a great communicator. Not only did he solve my troubleshooting task with ease, but clearly shows a lot of pride in his work, doing a great job of documenting cleanly all his changes made to my site.”
Client via Codeable, 5/5
Questions
Questions I get on the first call
We’ve been hacked. What do we do right now?
Take the site offline or behind a password if you can, change every password and key, and keep the logs. Then book a call or email me; I respond the same day for incidents.
Is a security plugin enough?
It helps, and it is not a strategy. Most compromises I see are abandoned plugins, shared passwords, open endpoints and no update policy. The audit covers the parts a plugin can’t.
Can you help with a customer’s security questionnaire?
Yes. I’ll answer it with you, honestly, and fix the gaps it exposes. Many US customers now require this from vendors.
What does it cost?
The audit is a fixed fee. Fixes are quoted per item from the report. Incident response is hourly with a cap agreed at the start. Monthly care is a flat fee.
Tell me about the project.
Thirty minutes, free, no pitch. You’ll leave knowing what it would take.
Or email hello@samuelsilva.pt