WordPress security, and nothing else
Word Security is a WordPress security firm based in Adliswil, Switzerland, working remotely with businesses worldwide. We recover hacked sites, lock down vulnerable installs and keep them in shape afterwards.
The WordPress problems we handle
Malware and compromised sites
Malicious PHP and JavaScript, spam injections, redirects, backdoors and rogue administrators.
Malware removal →Security hardening
Access control, update hygiene, login protection, backups and plugin risk.
Hardening →Ongoing protection
Update oversight, regular security checks and backup verification.
Ongoing security →A narrow focus, on purpose
We don't do generic hosting security, other content management systems or general IT support. WordPress sites tend to fail in familiar ways: an outdated plugin, an old administrator account, a backup nobody has tested. Working only on WordPress means we know where to look first, and what a clean WordPress install is supposed to look like.
Remediation and hardening
Remediation
We preserve a copy first, investigate files, database, users and scheduled tasks, remove the compromise, then find and fix how it happened. See the malware removal process.
Hardening
We review first and change second, tell you what each change touches, and document the result. See security hardening.
Plain language, in writing
You get findings and recommendations explained without jargon, in a written summary you can keep and forward.
Honest about limits
No cleanup or hardening is a guarantee, and no site is unhackable. We say what we fixed and what remains outside the site's control.
How we handle access, credentials and data
- We ask for temporary access that you control and remove when the work is finished.
- Please never send passwords through the contact form or by email. We'll tell you how to share access once we've replied.
- Information you send is used to respond to your request. See the privacy policy.
- We only work on sites we've been engaged for. We don't probe or test sites we haven't been asked to look at.
How we find and contact businesses
If you received an email from us, here is how it came about, so you can judge it for yourself.
- We only look at what any visitor to your public website can see, such as whether it runs WordPress. We don't try to log in, guess passwords or test for weaknesses.
- Our checks identify themselves with a user agent that points back to our legal notice.
- Each message is reviewed and sent by a person, not by an automated bulk sender.
- Outreach emails come from a separate domain,
wordsecurityaudit.com, and every one carries a one-click unsubscribe link that works without logging in. - Once you unsubscribe, we don't contact that address again.
Questions about data? See our privacy policy and legal notice.
Talk to us about your site
Tell us what's happening, or what you'd like to prevent
We'll get back to you with next steps.