Security and mail hardening
Cleanup after a compromise, and the configuration that stops the next one. Includes getting your mail into inboxes.
Cleaning malware off a site is the easy half. The hard half is finding how it got in, because otherwise it comes back within a fortnight.
Cleanup
Every modified file identified against a known-good copy, injected content removed from the database, unfamiliar administrator accounts and scheduled tasks audited, and the entry point found — usually an outdated plugin, a reused password, or a neighbouring site on the same shared account.
Hardening
- File and directory permissions set so PHP cannot write where it does not need to.
- Administrative access reviewed, unused accounts removed, two-factor authentication where it makes sense.
- XML-RPC, author enumeration and version disclosure closed off.
- TLS configuration and security headers set correctly at the server.
- Backups verified by actually restoring one, which is the only test that counts.
Mail that arrives
SPF, DKIM and DMARC configured, aligned and verified against real deliveries. If your order confirmations and invoices have been landing in junk folders, this is usually why, and it is usually a one-day job.