A security professional’s own website is a calling card. If it shows a certificate warning or leaks version numbers, that says something. Here is how I audited and hardened this WordPress site, and the order I did it in.
1. Start with an honest audit
Before changing anything I recorded the baseline: platform and versions, plugins, HTTP response headers, TLS status and DNS records. The audit turned up the usual suspects for a small site:
- The hosting provider’s free TLS certificate had failed to install, so some visitors saw a “certificate is for a different address” warning while others, served by the CDN, did not. Intermittent problems are the easiest to miss.
- Missing security headers: no HSTS, a minimal Content-Security-Policy, no X-Content-Type-Options and no Permissions-Policy.
- The server advertised its exact PHP version in every response.
- Outdated plugins, one plugin installed but never configured, and several inactive leftovers.
2. Make sure you can go back
Every change was preceded by a full backup of files and database, and the redesign was built on a staging copy rather than the live site. A rollback procedure was written down before it was needed. In incident response we say you should never touch evidence without a copy; the same applies to production systems.
3. Fix transport security first
Re-issuing the certificate and forcing HTTPS removed the browser warnings for everyone. HSTS then tells browsers to refuse plain HTTP for this domain in future, closing the window for downgrade attacks on hostile networks.
4. Reduce the attack surface
- Updated WordPress components to current versions and removed or deactivated plugins that were not in use. Code that is not running cannot be exploited; code that is installed but forgotten often is.
- Blocked XML-RPC, a legacy interface frequently abused for password-guessing and amplification.
- Stopped advertising software versions in response headers.
- Added browser security headers: X-Content-Type-Options, Referrer-Policy, a restrictive Permissions-Policy and frame protection.
5. Protect identities
The hosting account and the WordPress administrator are the keys to everything. Both should use unique passwords from a password manager and two-factor authentication. Credentials are never shared with tools or assistants; sign-ins are always done by the account owner.
6. Minimise personal data
A portfolio does not need a phone number, which invites spam and voice phishing. Photos straight from a phone can carry GPS coordinates in their metadata, so the portrait on this site was re-encoded with all metadata stripped.
7. Keep it that way
Hardening is not a one-off project. Daily backups, automatic updates, a malware scanner and a periodic header check keep the site from drifting back. You can check any site’s headers with a free tool such as securityheaders.com, and its TLS configuration with SSL Labs.
None of these steps is exotic, and that is the point: most compromises of small sites exploit exactly these gaps.