WordPress security hardening for a typical single site runs $300–$1,200 as a fixed-fee project. That is an estimate based on remote work with US, UK, and Australian clients — not a quote. Every site scopes differently based on complexity, current state, and what you need when the project ends.
This guide breaks down what drives the price, what is included at each tier, and how hardening cost compares to the alternatives.
Price ranges by site type
| Site type | Estimated hardening cost | Timeline | Notes |
|---|---|---|---|
| Simple brochure site (5–10 plugins) | $300–$500 | 1 day | Straightforward config, few users |
| Business site with forms/CRM | $500–$800 | 1–2 days | More plugins, integrations to test |
| WooCommerce store | $700–$1,200 | 2–3 days | Checkout testing, payment webhooks, customer data |
| Multisite network | $800–$1,500+ | 2–4 days | Per-site config, network-level rules |
| Post-cleanup hardening | $500–$1,200 | 1–3 days | Assumes cleanup already done |
| Combined cleanup + hardening | $800–$2,500+ | 3–7 days | See malware removal vs hardening |
All figures are estimates. I provide a fixed-fee quote after the free security check.
What is included in a hardening project
A standard hardening engagement covers:
Authentication and access
- 2FA setup and enforcement for Editor+ roles
- Login rate limiting configuration
- User account audit and role downgrade
- REST API user enumeration block
Configuration hardening
- wp-config.php security constants (`DISALLOW_FILE_EDIT`, `FORCE_SSL_ADMIN`, debug settings)
- File permission review and correction
- Security key verification
- XML-RPC disable (if unused)
- PHP execution block in uploads
Firewall and monitoring
- Cloud WAF setup or tuning (Cloudflare)
- Security plugin selection, installation, and configuration
- File-integrity monitoring and scan scheduling
- Alert configuration
Backup verification
- Confirm off-site backup storage
- Verify retention period (30+ days)
- Test restore to staging
- Document restore procedure
Documentation
- Written summary of all changes
- Checklist of remaining items for your team
- Recommended ongoing maintenance cadence
What is not included
These are separate services with separate pricing:
| Service | Estimated cost | When needed |
|---|---|---|
| Malware removal / cleanup | $500–$2,000+ | Active infection present |
| Ongoing maintenance | $75–$300/month | After hardening, for continued updates and monitoring |
| Plugin replacement | $200–$1,000+ per plugin | Abandoned plugin with no maintained alternative |
| Full site rebuild | $3,000–$15,000+ | Unmaintainable stack, end-of-life PHP, abandoned theme |
| Penetration testing | $1,500–$5,000+ | Compliance requirement, not standard hardening |
| SSL certificate installation | Usually $0 (Let's Encrypt) | If not already configured |
What drives the price up
More plugins. Each active plugin is a potential vulnerability and a compatibility test during hardening. A site with 40 plugins takes longer to audit and configure safely than one with 12.
WooCommerce. Payment flows, webhooks, customer data, and checkout integrity require testing after every security change. Stores cost more because breaking checkout is not acceptable.
Prior compromise. Hardening after cleanup includes verifying the entry point is patched, checking for residual backdoors, and often rebuilding trust in the backup chain. Starting from a known-clean state is faster and cheaper.
No staging environment. Changes made directly on production require more careful sequencing, low-traffic scheduling, and rollback planning.
Multisite. Network-wide configuration plus per-site verification multiplies the work.
Custom infrastructure. Non-standard hosting, headless setups, or complex CDN/proxy configurations add scoping time.
What drives the price down
Clean starting point. Site never compromised, updates reasonably current, few users.
Good hosting. Managed WordPress hosts (Kinsta, WP Engine) already provide server-level security, daily backups, and staging. Less to configure from scratch.
Existing staging. Changes tested safely before production deployment.
Small plugin count. Fewer compatibility concerns, faster audit.
Clear scope. "Apply the standard hardening checklist" is faster than "make us secure" with no defined endpoint.
Hardening cost vs alternatives
| Option | Cost | Outcome |
|---|---|---|
| Hardening project | $300–$1,200 | Configured, documented, tested |
| DIY from checklist | $0 (your time) | Depends on your WordPress expertise |
| Security plugin only | $0–$119/year | Partial — no config, user audit, or backup verification |
| Malware cleanup (reactive) | $500–$2,000+ | Clean site, no prevention |
| Repeated cleanups | $500–$2,000+ each time | Expensive cycle without hardening |
| Do nothing | $0 until incident | Incident cost varies wildly |
Hardening is the cheapest path that actually prevents the problem. Cleanup after the fact always costs more than prevention — often 2–5x the hardening price for a single incident.
Ongoing cost after hardening
Hardening is not a one-time fix for a moving target. Plugins release updates, users come and go, and new vulnerabilities get published weekly.
| Maintenance level | Estimated monthly cost | Includes |
|---|---|---|
| DIY | $0 | You run updates, audits, backup tests yourself |
| Basic care plan | $75–$150/month | Scheduled updates, backup monitoring, monthly scan review |
| Full care plan | $150–$300/month | Updates on staging, backup verification, security monitoring, priority support |
| Agency portfolio plan | Custom | Bulk pricing for multiple client sites |
See WordPress security maintenance plan for what ongoing maintenance includes.
How to get an accurate quote
- Free 15-minute security check — send your URL, get publicly visible findings
- Scope call — discuss site type, plugin count, WooCommerce, prior incidents, staging availability
- Fixed-fee proposal — itemized scope, timeline, and price
No hourly billing surprises. The quote is the price unless you add scope mid-project.
Frequently asked questions
Is the free security check really free?
Yes. You get findings from publicly visible signals whether or not we work together. No obligation to purchase hardening.
Can I pay hourly instead of fixed-fee?
I quote fixed-fee for hardening because the scope is well-defined. Hourly billing makes sense for open-ended investigation or custom development, not standard hardening.
Do you offer retainers for agencies?
Yes. Agency portfolio plans cover hardening baselines across multiple client sites plus ongoing maintenance. Scoped individually based on site count and complexity.
Is hardening tax-deductible?
Security services for a business website are generally operating expenses. Consult your accountant — I am a developer, not a tax advisor.
What if the site needs a rebuild instead of hardening?
I will tell you on the free check. Paying $800 to harden a site running PHP 7.4 with an abandoned theme and 30 inactive plugins is poor value. A rebuild or migration is more honest.
Get a free 15-minute security check
Send your URL. I will review what is publicly visible and give you an honest assessment: whether hardening is the right move, what tier your site falls into, and a ballpark estimate before any commitment.
September 2, 2026
WordPress Security Hardening Checklist (2026)
September 2, 2026
