Find out what is broken before someone else does
For founders, store owners, and agencies who treat security as more than a checkbox. We test your site the way an attacker would and document every finding with a fix.
250+ projects shipped
Who this is for
If any of this sounds like you, we should talk.
You handle customer data and need real assurance
Logins, payments, PII, health information. You want to know what an attacker would find, not just whether a plugin scanner is happy.
You inherited a site and do not trust it
Unknown plugins, mystery admin users, outdated themes, suspicious file modifications. You want a clean baseline before something breaks publicly.
Your customer or auditor is asking
An enterprise prospect is asking for a security review before they sign. You need a real report from a real engineer, fast.
You just survived an incident
Something happened: defaced page, fake admin user, weird redirects, payment skimmer. You want a forensic look plus a hardening plan.
What changes for you
Outcomes you can point to, not features you can ignore.
- A documented list of every vulnerability we found, ranked by severity and exploit difficulty.
- A prioritized remediation plan with clear fixes (not just "update plugin").
- Hardening of the layers attackers actually use: authentication, file uploads, REST API, admin surface, third-party integrations.
- A clean security posture report you can show to enterprise customers, auditors, or your board.
- Optional ongoing security monitoring through a Care Plan tier.
What is included
Scope, organized by phase.
Discovery (Phase 1 of 5)
Phase 1
Discovery
What we lock down in this phase before moving on.
- Site reconnaissance (subdomains, exposed services, tech fingerprinting)
- User and role audit
- Plugin, theme, and dependency inventory
- Hosting and DNS configuration review
How an engagement works
From hello to handoff, step by step.
Scope and rules of engagement
We agree on what is in scope, what is off limits, testing windows, and notification protocol. You sign a testing authorization, we begin.
Reconnaissance
We map your attack surface from the outside in. Subdomains, exposed services, plugins, dependencies. Anything an attacker would see in the first hour.
Active testing
Authentication, authorization, input validation, file uploads, REST API, third-party integrations. Manual testing with tooling, not just an automated scan.
Report delivery
Findings ranked by severity, with reproduction steps, evidence, and recommended fixes. Critical issues get a same-day heads up, not a calendar invite.
Remediation and verification
If scoped, we ship the fixes. We always re-test what was fixed to verify it actually closed the hole. You get a final posture report.
Case study
Aryma Labs / MM Courses
- Problem
- A client WordPress site had a privilege escalation vulnerability in a third-party plugin that would have allowed any registered user to take admin access. The plugin had no public CVE at the time we found it.
- What we built
- We caught the issue during a security audit, documented the exploit path, disclosed it responsibly to the plugin vendor, and hardened the site (patched, removed the affected component, audited every admin user, added monitoring on privilege changes).
- Result
- Zero exploitation in the wild on the client site. The case became a documented LinkedIn write-up that drove inbound interest from other founders worried about plugin supply chain risk.
Why us
What you get with WitsCode that you don't get elsewhere.
Hunted by a security researcher, not a checklist
Our founder is on the OSCP track and hunts vulnerabilities for fun. We have caught privilege escalation, auth bypass, and unauthenticated file uploads in the wild on client sites.
Manual testing, not just an automated scan
Scanners catch the easy stuff. The findings that actually matter (logic flaws, broken authorization, unsafe defaults) require a human who knows the stack.
We can fix what we find
Many auditors hand you a PDF and disappear. We can ship the remediation as part of the engagement, including code-level fixes on WordPress, Shopify, and custom apps.
WitsCode rebuilt our Shopify store so it finally converts the traffic we were already getting. They understand speed and storytelling in equal measure, and the store has been a real growth lever since launch.
Free download
WordPress Security Hardening Checklist
The top 10 things to lock down on any WordPress site this week. Admin surface, plugin hygiene, file uploads, REST API, backups. Use it yourself or send it to your team.
Frequently asked
Questions before you reach out.
Ready to know exactly where your site is exposed?
Start a project. We will scope a security audit that matches what your business actually risks.