Security · 2022
Hardening a client's WordPress site with layered security controls, chosen to shrink the attack surface without over-spending. The goal was matching the right protections to what the site actually needed, cost-effective and tailored, not a pile of plugins for the sake of it.
Security in layers. No single control makes a site safe, so the work was stacking controls that each close a different gap, access, encryption, patching, and monitoring, while keeping the whole thing practical for a client to live with.
A staging environment
A safe copy of the site to test new plugins and updates on before they ever touched production, so nothing risky went live untested.
Access controls
Logon policies, password complexity, role-based access, MFA, CAPTCHA, and access control lists, layered so a single weak point doesn't hand over the site. Default settings reconfigured off their insecure out-of-the-box state.
TLS encryption
HTTPS with SSL/TLS enabled, so traffic between visitors and the site is encrypted in transit.
Disciplined updates
Applying minor and major updates for plugins and WordPress core as needed, tested in staging first, since outdated components are the most common way these sites get breached.
Log review
Aggregating data from multiple sources and reviewing it, separating false positives from real signals, so alerts meant something instead of adding noise.
Beyond the controls themselves, the project was about picking solutions that fit the client, effective, affordable, and sized to the actual risk. Security that's too expensive or too heavy to maintain doesn't get kept, so matching the protection to the need was the real work.