"Update your CMS plugins" is advice. We do the work: a WAF in front of your site, security headers configured, brute-force protection live, file-integrity monitoring running, and an automated nightly scan that flags any new file with sketchy patterns.
Cloudflare or AWS WAF with OWASP-top-10 rule sets enabled, rate limiting, and bot challenge for endpoints with abuse history.
HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy. CSP tuned to your stack so nothing legitimate breaks.
Login endpoints rate-limited, CAPTCHA on N failures, lockout policies, IP-based reputation scoring on suspicious patterns.
Daily diff against a known-clean snapshot. Alert on new PHP files in upload directories. Catches webshells before they're abused.
Core, plugins, dependencies — auto-updated on a schedule that respects your release window. Critical patches go immediately.
Disabled XML-RPC, hidden version strings, unused plugins purged, default admin URLs renamed, error verbosity reduced in prod.
Pricing and the full Shop are visible to signed-in members. Create a free account in 30 seconds — no payment info needed.