From a free scan to full continuous protection — choose the level of security your site needs.
All packages and subscriptions are priced per site.
Find out exactly where your website is vulnerable. We can only fix a problem once we know what it is. The assessment takes about 60 seconds and costs nothing.
Quick vulnerability check for your WordPress site
Now that we know the problem, we can solve it. Choose the option that best fits you: a step-by-step Fix-It Guide, Emergency Entry, or Security Lockdown.
AI-generated detailed patching instructions
Pre-built recovery channel in case your site is compromised
Fixes every issue found in your free scan plus deep server-level hardening
Sentinel watches your site 24 hours a day, continuously supervising and maintaining its security system. To use Sentinel, the Security Lockdown package has to be installed first. Choose the annual plan with a 25% discount — and get Security Lockdown free with it.
Continuously monitors your security system — backs up, updates, and alerts you if you ever need to step in.
With Hacked-Site Recovery, our system gets to work on restoring your site right away: it locks everything down and rebuilds the website from clean sources. If you have a backup from before the break-in, your site will end up almost exactly as it was, only now protected by a much stronger security system. You could have your website back within a few hours...
Automated recovery for compromised WordPress sites
Side-by-side comparison of all Security and Sentinel packages
| Security services | |||
|---|---|---|---|
| Feature | Fix-It Guide | Security Lockdown | Emergency Entry |
| How it's bought | One-time | One-time | Ongoing |
| Deep vulnerability scan: plugins and themes matched against CVEs, SSL/TLS check | |||
| Personalised fix plan for every issue found, in order of severity | |||
| Exact .htaccess and wp-config.php snippets, with where to paste them | |||
| Uses the settings of security plugins you already have first; a new plugin only as a last resort | |||
| Detects weak TLS ciphers (D(HE)ater) and how to fix them | |||
| Step checklist and downloadable PDF | |||
| ITBit Assistant plugin installed and paired* | |||
| Verified database backup before any change, with an encrypted off-site copy | |||
| Health check after every step; automatic rollback if the site goes down | |||
| Security headers (X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options) | |||
| Content-Security-Policy: safe directives enforced, the strict policy rolled out in report-only mode | |||
| HTTPS enforced with a strong HSTS policy | |||
| XML-RPC disabled | |||
| Sensitive files blocked (readme, .env, .git, error_log, .user.ini, WooCommerce logs); public phpinfo removed | |||
| Unsafe HTTP methods rejected (PUT, DELETE, PATCH, TRACE) | |||
| Dashboard file editor disabled | |||
| Directory listing disabled | |||
| WordPress, plugin and theme versions hidden | |||
| User enumeration blocked; login names masked in feeds, the REST API, oEmbed and sitemaps | |||
| REST API restricted | |||
| Anti-bot challenge on the login page | |||
| SameSite attribute on cookies | |||
| Public wp-cron disabled | |||
| Server fingerprint headers removed (e.g. X-Powered-By) | |||
| wp-config.php hardened (debug off, security constants) | |||
| Plugins and themes updated, with a health check per component | |||
| Unused themes removed (active and parent theme kept) | |||
| Virtual patch for a known vulnerability until an update exists | |||
| Wordfence installed and configured (licence, reference configuration, firewall), with your approval | |||
| Post-fix verification scan and a before/after PDF report by email | |||
| One-click auto-fix (plugins, themes, wp-config) | |||
| WordPress-independent access channel (SFTP, FTPS or FTP), credentials stored encrypted | |||
| Live test of the channel | |||
| Reinstalls and re-pairs the ITBit Assistant over the channel, even if an attacker removed it | |||
| Upload your own backups (ZIP, SQL) | |||
| Weekly full backup: the database and every file (content, media, themes, plugins, settings), encrypted; last 4 retained | |||
| Continuous monitoring | |
|---|---|
| Feature | Sentinel |
| How it's bought | Ongoing |
| Daily automated security scan | |
| Auto-fix: new issues found by the daily scan are fixed automatically | |
| Uptime monitoring every 5 minutes, with downtime alerts | |
| Daily encrypted database backup to external storage; last 7 retained | |
| Backups verified every 6 hours, alert on an incomplete backup | |
| Quarterly restore drill, without touching the live site | |
| Hourly patch and plugin update monitoring | |
| 24/7 AI Security Advisor with full site context | |
| Audit log (users, plugins, themes, content, uploads, core files, settings) | |
| Hourly file snapshots and an event log kept with us (logins, admin changes, state-changing requests) | |
| Malware detection with instant email and Telegram alerts | |
| Vulnerability monitoring with CVE matching | |
| Hourly check that monitoring is really working on the site | |
| Detailed weekly security report | |
| Everything in Emergency Entry included | |
| Emergency help | ||
|---|---|---|
| Feature | Emergency Entry | Hacked-Site Recovery |
| How it's bought | Ongoing | One-time |
| WordPress-independent access channel (SFTP, FTPS or FTP), credentials stored encrypted | ||
| Live test of the channel | ||
| Reinstalls and re-pairs the ITBit Assistant over the channel, even if an attacker removed it | ||
| Upload your own backups (ZIP, SQL) | ||
| Weekly full backup: the database and every file (content, media, themes, plugins, settings), encrypted; last 4 retained | ||
| One purchase covers one site and one incident, re-runnable until the 30-day watch ends | ||
| Forensic backup of the compromised state | ||
| Site locked: logins blocked, every session ended | ||
| Restore from a pre-breach backup: ours, or your own uploaded to Emergency Entry, over the emergency channel if needed | ||
| WordPress core and plugins reinstalled from official sources | ||
| Themes rebuilt from official sources | ||
| Unknown files that can't be replaced moved to quarantine | ||
| Rule-based database clean-up: unverified admins demoted, suspicious settings and scheduled tasks handled | ||
| New security keys; every session and application password revoked | ||
| Wordfence and every Security Lockdown fix | ||
| Wordfence scan; if it still finds something, the rebuild runs again | ||
| Analysis of how the attacker got in | ||
| Site reopened | ||
| 30-day watch: re-hack, malware and downtime alerts, with a closing report | ||
* The ITBit Assistant plugin must be downloaded and installed manually on your site.