Description
Scope of work • Full security audit of the WordPress/WooCommerce install (core, theme, plugins, file permissions, user roles, exposed endpoints) • Malware/backdoor scan and cleanup if anything is found • Harden wp-admin, XML-RPC, REST API, and login (rate limiting, 2FA, brute-force protection) • Cloudflare WAF configuration: custom rules, bot management, rate limiting on checkout/cart/login, and blocking non-human traffic hitting expensive endpoints • Server-level hardening: firewall, fail2ban, SSH, PHP config, file integrity monitoring • Checkout and payment flow security review (card testing / carding attack prevention, fake order and spam order filtering) • Automated offsite backups with a tested restore procedure • Monitoring and alerting so we know when something’s wrong before customers do • Short written handoff doc covering what was changed and how to maintain it Required experience • 3+ years securing WordPress/WooCommerce stores in production • Strong Linux VPS admin skills (Nginx/Apache, PHP-FPM, MySQL) • Deep Cloudflare experience — WAF custom rules, not just turning on the toggle • Proven history cleaning up hacked or bot-flooded WooCommerce sites • Understands e-commerce-specific threats: card testing, checkout abuse, credential stuffing, scraping Nice to have • Experience with high-volume transactional email deliverability • Familiarity with FluentCRM or similar • Security certifications or documented CVE/bug bounty work Engagement Starts as a fixed-scope audit