Then the extensions. Millions of installations are carrying plugins that have not seen an update in years. That is the first place I look, and almost always the richest. What I find there goes. Not deactivated, deleted. A deactivated plugin is still sitting on the disk, and a hole in the file system does not care whether somebody unticked a box in the dashboard.
WordPress
Service for
WordPress
Your website is up. That says nothing about whether it is secure.
What Hardening, repair, development
For Websites running on WordPress
Where Servers in EU data centers
Contact my@intelligent-pixel.com
I specialize in maintaining and securing websites that run on WordPress. Repair after a break-in, migration to my own infrastructure, ongoing updates and monitoring, and development where the standard parts are not enough.
Why websites running on WordPress get attacked
The problem is rarely one line of software. It is the way the site is run.
In July 2026 the German Federal Office for Information Security (BSI) issued a cyber security warning about WordPress at criticality level 3 of 4. 2 chained vulnerabilities, CVE-2026-60137 and CVE-2026-63030, together known as wp2shell, allowed unauthenticated remote code execution. The BSI recorded that proof-of-concept code appeared over the course of the weekend and that reports of first exploitation had already come in. Publication and attack were not weeks apart.
That is the rare case, and it was fixed quickly. The common case is duller. An installation gets set up, it runs, and after that nobody looks after it. Extensions stay where they are, long after a vulnerability in them has been publicly documented. The login path is the same everywhere by default, with no limit on attempts. Do nothing and you accumulate attack surface without noticing any of it.
Which newly published vulnerabilities affect WordPress is in the Threat Log.
When it happens, you do not see it
A break-in goes unnoticed because the site still looks normal. It loads, the contact form arrives, the dashboard reports nothing. In the background the site is put to work for someone else: malware served to your visitors, a phishing page in a directory you never open, spam sent in your name.
The bill arrives before anyone says the word attack. Google flags your domain as harmful. Your server address lands on blocklists and your mail stops arriving. Your host pulls the plug without discussing it with you. In the cases I take on, that is almost always the moment someone writes for the first time.
Themes, plugins, and why I hard-code your site
A theme you buy for 59 euros is not a problem because it was cheap. It is a problem because 200,000 other people bought the same one. Find a hole in it and you have not found a website. You have found a list.
Then there is everything those kits ship with: sliders, form builders, icon libraries, demo importers, half a dozen add-ons you never asked for and never use. Every one of them is somebody else’s code running on your server. Every one of them is a door.
Page-builder theme
Hard-coded
Assembled from a database and PHP on every request
Sits there ready
Sliders, form builders, demo importers nobody ordered
Only what has to work: blog or shop
Thousands of others run the same code
Your own code, full source included
Every extension is a door
Smaller attack surface, noticeably faster
I build it differently. The site itself I hard-code. It is not assembled out of a database and a stack of PHP on every request. It is simply there, finished. The only things left under management are the things that actually need managing: your blog posts, your store. Nothing else has any reason to exist at runtime.
That does 2 things. Your site gets faster, noticeably. And the attack surface shrinks to the part that has work to do. What does not run cannot be exploited.
What is left, the store or the blog, I go through piece by piece. Nothing gets a pass here just because it came from a big name.
What I do
Repair after a break-in
I reconstruct how somebody got in and what they did once inside, remove what does not belong there, and close the way back. Where a clean repair can no longer be justified, I tell you so and we rebuild. What I find, I document, so that you can prove it.
Migration to my own infrastructure
Servers in EU data centers, under my control, hardened and monitored. After that your site is no longer one tenant among a thousand on a machine nobody knows.
Updates and monitoring in day-to-day operation
Core and extensions stay current, and somebody actually looks. It is the least dramatic item on this page and the one that prevents most cases.
Hardening with IPServerSec for WordPress
My own hardening and early-warning system, tuned to an installation like yours. What it does is set out in full under IPServerSec.
Plugin development to your requirements
For when no off-the-shelf module does what you need and you would rather not install 3 extensions to solve one task.
Theme development
The design built rather than bought from a kit that 10,000 other sites are using.
Changes directly in the code
An installation that has grown over the years, with other people’s modifications in it, is not a reason to decline the job.
Since the update, nothing works
Blank page, error message, dead form, shop not taking orders. I find out which update broke what, bring the site back, and fix the cause instead of just rolling back.
What your site quietly sends elsewhere
Fonts from Google, embedded videos, tracking scripts: many sites pass their visitors’ addresses to third parties without the owner knowing. I find it and rebuild it so it stays with you.
Why the order matters after a break-in is on the home page.
How I handle outside content on my own site is in the privacy policy, under Fonts and third parties.
Common questions about the Service for WordPress
My site runs on WordPress and has been hacked. What now?
Don’t delete anything, and don’t start cleaning up. Whoever cleans up first deletes exactly what was supposed to prove later that they weren’t negligent. The order is: secure the evidence, close the hole, then clean up.
If the site is doing damage right now, have it taken offline, for example by your host. Taking it offline is not cleaning up. If personal data is involved, a 72-hour notification deadline may be running (Art. 33 GDPR). Whether it applies is something to settle with your data protection officer or lawyer, without waiting for my reply.
Write and tell me what’s going on. If I take the case, I reconstruct how somebody got in, close the way in, and document what I find.
How would I know my site has been hacked?
Often you wouldn’t, because the site still looks normal: it loads, the contact form arrives, the dashboard reports nothing. Most of my clients heard it from Google, from their host, or from a customer. Typical signs: Google flags your domain as harmful, your mail stops arriving because your server’s address is on blocklists, or your host pulls the plug.
Can you take over my site and look after it?
Yes. I move it to my own infrastructure: servers in EU data centers, under my control, hardened and monitored. After that, core and extensions stay current, and the site is hardened with IPServerSec for WordPress. There is no ticket system, no on-call service, and no SLA. There is somebody who actually looks.
Is my site sending visitor data to third parties?
Quite possibly, and often without the owner knowing: fonts from Google, embedded videos, tracking scripts. I find it and rebuild it so it stays with you. That is technical work, not legal advice. I’m not a lawyer.
What does it cost?
The hourly rate is EUR 149 net, billed per quarter hour started, and a deposit of EUR 500 net is due before work starts and is credited against the work done. I name the price for your case at the end of the evaluation, in a written quotation. You are only invoiced for what you commissioned in writing beforehand. Everything on the hourly rate, deposit, and process is under Pricing.
What you get is yours
You receive the full source code of every plugin and theme I build for you. That keeps you independent of me. Anyone who ties you in by withholding the code has not solved a problem. They have created a second one.
If your site is already behaving oddly, write to me. If it is not, that is the better moment.
WordPress is a registered trademark of the WordPress Foundation. intelligent piXel GmbH is an independent service provider and is not affiliated with the WordPress Foundation or Automattic Inc.