WooCommerce Security Hardening Specialist — Store Audit + Ongoing Protection

Scope of work • Full security audit of the WordPress/WooCommerce install (core, theme, plugins, file permissions, user roles, exposed endpoints) • Malware/backdoor scan and cleanup if anything is found • Harden wp-admin, XML-RPC, REST API, and login (rate limiting, 2FA, brute-force protection) • Cloudflare WAF configuration: custom rules, bot management, rate limiting on checkout/cart/login, and blocking non-human traffic hitting expensive endpoints • Server-level hardening: firewall, fail2ban, SSH, PHP config, file integrity monitoring • Checkout and payment flow security review (card testing / carding attack prevention, fake order and spam order filtering) • Automated offsite backups with a tested restore procedure • Monitoring and alerting so we know when something’s wrong before customers do • Short written handoff doc covering what was changed and how to maintain it Required experience • 3+ years securing WordPress/WooCommerce stores in production • Strong Linux VPS admin skills (Nginx/Apache, PHP-FPM, MySQL) • Deep Cloudflare experience — WAF custom rules, not just turning on the toggle • Proven history cleaning up hacked or bot-flooded WooCommerce sites • Understands e-commerce-specific threats: card testing, checkout abuse, credential stuffing, scraping Nice to have • Experience with high-volume transactional email deliverability • Familiarity with FluentCRM or similar • Security certifications or documented CVE/bug bounty work Engagement Starts as a fixed-scope audit + hardening project. If it goes well, we’ll move to a monthly retainer for monitoring, patching, and incident response. To apply, answer these: 1. Describe a WooCommerce site you secured — what was the threat, and what did you actually do? 2. What’s your approach to blocking bots without hurting real customers or SEO? 3. What tools do you use for monitoring and file integrity? 4. Your availability and estimated timeline for the initial audit. Please skip generic proposals. Applications that don’t answer the questions won’t be reviewed.