WordPress
Security Service
India

CV Infotech charges $30 per hour for WordPress security work from India. A one-time security audit and hardening engagement takes 6–16 hours depending on the size of the installation and number of plugins, putting the range at $180–$480. Ongoing monthly security monitoring — vulnerability scanning, file integrity monitoring, login protection, and the monthly report — takes 2–4 hours per month, or $60–$120/month. If a security incident requires remediation during the month, that work is charged at the same $30/hr rate. All work is scoped and agreed before it begins.

WordPress security hardening is a set of configuration changes that reduce the attack surface of a WordPress installation. Common hardening measures include: disabling XML-RPC (a frequent attack vector for brute-force attacks that bypass the standard login page); removing the WordPress version number from page source; moving wp-config.php above the webroot so it cannot be accessed via the web server; changing the default database table prefix from 'wp_'; disabling the built-in file and theme editor so compromised admin accounts cannot inject malicious code directly; enforcing strong passwords and two-factor authentication on all administrator accounts; blocking direct PHP execution in the uploads directory; and configuring security headers in the server configuration. Hardening is done once and remains in place unless the configuration is changed.

XML-RPC is a WordPress feature that allows remote applications to interact with WordPress — it was used by mobile apps, blogging clients, and cross-site publishing tools. It is still enabled by default in WordPress installations despite being largely superseded by the REST API. The security problem with XML-RPC is that it provides an alternative login endpoint that does not respect the rate limiting and brute-force protection applied to the standard wp-login.php page, and it allows multiple authentication attempts in a single HTTP request — meaning a single request can test hundreds of password combinations. For most WordPress sites, XML-RPC has no legitimate use and should be disabled. For sites that use it for a specific integration, access can be restricted to approved IP addresses only.

The most common WordPress compromise vectors, in order of frequency: outdated plugins with known vulnerabilities — bots scan for specific version numbers and exploit known CVEs within days of publication; weak or reused passwords — brute-force and credential-stuffing attacks against wp-login.php and XML-RPC; compromised hosting environments — shared hosting where another site on the same server is compromised, allowing lateral movement; themes with malicious code — nulled (pirated) premium themes that include backdoors; and social engineering against administrator users. WordPress core itself is rarely the exploit vector — the WordPress security team responds quickly to vulnerabilities and auto-updates handle core patches for most installations. The risk is almost always at the plugin and configuration layer.

Wordfence is a good plugin and provides genuine value — its firewall rules, malware signatures, and login protection catch a significant proportion of common threats. It is not sufficient on its own for a serious security posture. Wordfence does not configure security headers (it affects some HTTP headers but not the full security header set). It does not patch plugin vulnerabilities — it alerts on them. It does not harden the server configuration. Its malware signatures lag behind emerging threats. And as a plugin itself, it adds PHP execution overhead and can be disabled by an attacker who has already gained admin access. A complete WordPress security service uses Wordfence as one component of a broader configuration, not as a substitute for it.

WPScan is a WordPress-specific vulnerability scanner and the organisation behind the most comprehensive database of WordPress plugin and theme CVEs (Common Vulnerabilities and Exposures). While the National Vulnerability Database (NVD) covers general software CVEs, WPScan's database focuses specifically on WordPress components and often has coverage of WordPress plugin vulnerabilities earlier than the NVD. WPScan is the standard tool used by WordPress security professionals for plugin and theme vulnerability assessment. We run WPScan against every client's plugin list and cross-reference results with the NVD. When a new CVE is published for an installed plugin, we receive an alert and act within 24 hours.

HTTP security headers are directives sent by the web server with every page response that tell the browser how to handle the page's content. Content-Security-Policy (CSP) restricts which scripts, stylesheets, and resources the browser will load — preventing cross-site scripting attacks that inject malicious scripts. X-Frame-Options prevents your site from being embedded in an iframe on another site, which blocks clickjacking attacks. X-Content-Type-Options prevents the browser from guessing the content type of a response, which prevents MIME sniffing attacks. Strict-Transport-Security tells the browser to only access the site over HTTPS, even if the user types http://. These headers are checked by security scanners and are relevant for PCI-DSS compliance, GDPR technical measures, and general security audits. Most WordPress sites have none of them configured.

If your site has an active compromise — malware present, redirects to spam, Google Safe Browsing warnings, hosting suspension — you need our WordPress malware removal service, not the security service. Malware removal is the emergency response. The security service is the ongoing protection that prevents the next compromise. After malware removal, we typically recommend a security hardening engagement and then ongoing monitoring to prevent recurrence. Many clients who come to us after a compromise move to the security monitoring service once the site is clean — because they have now experienced what happens without it.

Yes. We configure two-factor authentication for all administrator and editor accounts using a time-based one-time password (TOTP) app — Google Authenticator, Authy, or 1Password — or email-based OTP where TOTP is not practical. We also configure backup codes for recovery. For sites with multiple administrators, we enforce 2FA as a requirement — users without 2FA configured are redirected to set it up on their next login and cannot access the admin until they do. 2FA setup is included in the standard security hardening engagement and does not require a separate project.

Our WordPress maintenance service is a complete monthly care package: plugin and theme updates, daily backups with verified restoration, uptime monitoring, security scanning, performance monitoring, and included development hours for minor fixes. Security is one component of the maintenance service. The WordPress security service is a standalone offering for clients who want security hardening and monitoring without the full maintenance package — either because they handle their own updates and backups, or because they want a specific security engagement before a compliance review or site acquisition. The two services complement each other and share the same team.

We provide a hardening report documenting every security measure implemented, and monthly security reports documenting the ongoing monitoring results and any findings. This documentation can be referenced in GDPR compliance programmes (as evidence of Article 32 technical measures), CCPA compliance programmes, and PCI-DSS SAQ-A self-assessments where Stripe or another hosted gateway handles card data. We do not provide a formal security certification — that would require a formal penetration test by a certified security firm — but the documentation we produce is appropriate for regulatory inquiries and internal compliance records.

Yes. The security audit and hardening engagement is a one-time fixed-price project. We audit the installation, produce a findings report, implement the hardening, and document everything. There is no obligation to sign up for ongoing monitoring. Some clients use the one-time audit before a compliance review, a site sale, or a new product launch, and then decide whether to continue with monitoring based on the audit findings. If the audit reveals active monitoring as necessary — a site with significant personal data, an eCommerce store processing orders, or a site with a history of past compromises — we will say so clearly and explain why. But the decision is yours.