WordPress Security Assessment for Two Websites

What this case study is based on

Completed Upwork engagement supplied by Xequent. Only what the project record actually shows is stated here. Where no measurable outcome was recorded, none is claimed.

The security problem

• Two WordPress sites needed assessment rather than a single-site checklist.
• The scope explicitly included necessary adjustments after assessment.
• The work required separating genuine risks from low-value findings.

Technical approach

The specific controls follow from the site's architecture and its observed traffic, never from a template. The workflow below is the reasoning behind the work, described at the level the project record supports.

1. Inventory WordPress core, plugins, themes and exposed functionality.
2. Review authentication, administrator access, file and configuration controls.
3. Check for known vulnerability indicators and suspicious changes.
4. Prioritize practical remediation based on risk and business impact.
5. Retest the important controls after changes.

Result and client evidence

• The supplied Upwork record confirms the completed assessment engagement.
• Because no client feedback or measurable outcome was supplied for this project, this case study does not invent one.

Detection and remediation are different jobs

A scan tells you what is recognisable. It does not establish how far an attacker moved, remove the persistence mechanisms left behind, or close the path they came in through. That is why a scan result is where an engagement starts, not where it ends.

On a compromised site the sequence that works is preserve evidence, contain, investigate, clean files and database, hunt persistence, then find the entry point. Skipping that last step is why sites get reinfected within a week of a cleanup that looked complete. The malware removal service covers the full sequence, and hardening is what changes the outcome next time.