How a website review starts
The first step is an operating inventory: WordPress, hosting, domain registration, DNS, business email, analytics, Search Console, Google Business Profile, backups, renewals, licenses, and the people who control each account. That prevents design work from hiding unresolved ownership or recovery problems.
What a useful review produces
- A clear record of the accounts, services, renewals, and access the business depends on.
- A prioritized list separating urgent stability or security work from normal improvements.
- Completed fixes or a scoped plan for WordPress cleanup, redesign, migration, backup, and maintenance.
- Practical documentation that another responsible operator can follow.
When security testing is separate
Routine hardening and maintenance are not the same as a penetration test. If the concern involves custom application behavior, authorization, sensitive APIs, or active exploit validation, that work is scoped separately through web and API penetration testing.
No flat package pricing
A simple service-business website does not need the same plan as a company with several domains, old email routing, abandoned plugins, or an actively compromised site. Work is priced after the target, access, urgency, and business outcome are understood.
For a self-check before requesting help, read the Small Business Website Security Checklist.