WordPress & Hosting Security
I've administered Linux servers behind a hosting provider and tested WordPress on shared hosting at the same time, so I know both the attacker's path and the operator's constraints. That combination helps when a plugin audit needs to end in a fix rather than a report.
- Typical timeline
- 3 to 10 days
- Engagement
- Fixed scope, fixed fee
- Deliverable
- Report, PoC evidence and retest
What the work covers.
Plugin & theme audits
Source review for authentication bypass, insecure file upload, privilege escalation, SQL injection and capability-check mistakes.
WordPress hardening
File permissions, login protection, XML-RPC and REST exposure, security headers, WAF rules and an update strategy.
Shared-hosting review
Account isolation, PHP configuration, open_basedir, cron and mail abuse paths, and cross-account risk on the platform.
Incident follow-up
Post-compromise review covering the entry point, persistence, scope, and the hardening that stops the repeat.
Vulnerability reporting
Responsible disclosure to vendors and bug bounty programs, with reproduction steps they can use.
How the engagement runs.
No engagement starts without a written scope and agreed rules of engagement. Testing windows, contacts and escalation paths are fixed before anything is touched.
What I need from you
- Scope: URLs, apps, IP ranges or accounts in scope
- One technical contact and one escalation contact
- A testing window, or written approval to test 24/7
- Credentials for the roles that should be tested
- 01
Scope
A short call, then a written scope. Targets, rules of engagement, testing windows and anything that is out of bounds.
- 02
Test
Manual work against the real attack surface, with automated tooling where it helps. Findings are confirmed before they reach the report.
- 03
Prove
Every issue comes with reproduction steps, a CVSS score and a realistic impact statement. Critical is just a word without evidence.
- 04
Verify
After remediation I retest each finding and confirm it is closed. Most engagements stop before this step. This is the one that counts.
Often paired with
Application & API Penetration Testing
Manual, OWASP-aligned testing of your web app and APIs. Authentication, access control, business logic, and the flaws that only appear when someone actually tries to break in.
Cloud & Infrastructure Security Review
A focused review of the cloud and Linux estate your product sits on. Identity, object storage, network exposure, and the CDN edge in front of it.
Ready to scope this work?
Send a short description of the environment and what you need to know. You will get an honest read on scope, timeline and whether this is the right engagement.
Typically replies within one business day. NDA on request.
enes.ismaili@gmail.com