WordPress Security Consulting

Consulting & Training

I am a WordPress Security Consultant, and I can help improve your security and bring you peace of mind. Every relationship is different but areas I think I might be particularly suited in working with you are:

• Providing a security audit of your site, to help identify issues that might cause you problems.
• Providing security training yourself, your colleagues and potentially your customers
• Helping with specific security issues, for example hacked sites
• Help building out strategic overview of security within your organisation

This can be one off short “power hour” consultancy through to longer engagements such as single day workshops (online only at the moment) to taking a more direct hands on approach.

I have worked both at a web hosting company and managed a WordPress development agency which gives me the ability to understand a lot of the parts of your business needed to help you tackle problems not just from a technical perspective but through business processes as well.

I’m here to help and to bring you peace of mind. Let me help you sleep soundly at night and not be worrying if you will have an online business tomorrow.

Security Site Audit

A website security audit gives you a snapshot of how well your site is doing, an audit looks at a range of aspects of your site and gives you a concise list of actions to take to improve your site in the short, medium and long term.

My website security audits, try to be jargon free, and contain actionable information that your organisation can use straight away.

While each audit is bespoke to the client and scope of the project (what is being tested) they normally include:

• Code review of custom code on the site
• Use of automated tools to simulate a bad actor attack vectors
• Manual investigation of the site
• Evaluation of Plugin and themes on the site.
• Validation of security practices

Audits are designed to identify issues before they become problems, and are ideal during site builds but equally audits can be performed on live sites and as part of a regular review process.

Plugin/Theme Audits

I am a Dev/Sec/Ops person. I wrote one of the very first commercial plugins available for WordPress, it was a membership plugin that frankly sucked after many years and iterations without a refactor. Combine this with having worked with companies like PayPal and building donation platforms for the World Food Programme and I have a good inkling of what you might be going through. I’ve also more recently worked at a Manage WordPress host where I have had to audit my fair share of truly rubbish plugins, causing slow downs and more importantly vulnerabilities.

We can catch those vulnerabilities early with a Plugin/Theme audit. What’s in a Plugin/Theme audit:

• Automated code review, using a combination of static analysis and code sniffing
• A manually code review going line by line
• Automated testing of all plugin endpoints looking for all those sneaky SQL injections and XSS attacks.

A report that provides actionable insights for you to improve your plugin and theme, in addition I will show you how you can do much of this testing yourself so you can have your own mini audits built into your pipeline.

Consulting & Training

I am a Dev/Sec/Ops person who can probably help you in many parts of your agency. Every relationship is different but areas I think I might be particularly suited in working with you are:

• Security audits of sites, plugins, themes and implementing audits into your workflows
• Providing security training for staff and clients
• Helping with specific security issues, for example hacked sites
• Help building out strategic overview of security within your organisation
• Helping your development team level up in terms of system administration, server admin and things like continuous integration.

This can be one off short “power hour” consultancy through to longer engagements such as single day workshops (online only at the moment) to taking a more direct hands on approach.

Having previously run a development agency I’m uniquely suited to working alongside yours, I understand the pressures and issues you are under, I know that feeling when the client really needs this solved.

I’m here to help and to build on our successes together, working behind the scenes and keeping your data and issue confidential.

Retainers

Most of my engagements are for a single or couple of days of my time, to help solve a specific problem. However, retainer based engagements allow me to work deeply with your agency.

Retainer based engagements are really suited to longer security, maintenance and performance projects or mini projects to assist your team over a period of time. What might that look like? Well, for example, a 3 day a month retainer over a couple of months might look like this.

In month 1 the first 3 days are spent looking at longer term strategies and performing security and performance audits. Before identifying a specific first project, for example helping to scope and showing the benefits for continual integration tooling processes and mapping how that should look. In month 2 helping directly with the build phase provides plenty of opportunities to advise on problems and bottlenecks. At the same time we can start