Harden WordPress Firewall & Server

My WordPress site is currently offline after malicious files were discovered on the server. I need it cleaned and brought back online, but more importantly I want to stop this from ever happening again. The immediate focus is firewall and server-side security; user authentication tweaks and data-at-rest encryption can follow once the house is no longer on fire.

There are no security plugins installed yet, so you’ll be working from a clean slate. Feel free to recommend and configure the tools you trust most—Wordfence, Sucuri, ModSecurity, Fail2Ban, or a custom stack—as long as the final setup keeps attacks out and performance intact.

Acceptance criteria
• Every malicious file and injected line of code is removed, with the site fully functional and reachable.
• A Web Application Firewall is in place, properly tuned for WordPress traffic.
• Server settings are hardened: correct file permissions, disabled risky PHP functions, sensible rate limits, automatic core/plugin updates, and secure backups.
• Ongoing monitoring reports suspicious activity to my email.
• A brief hand-off document explains what was fixed, which rules were applied, and any routine tasks I should perform.

SSH/cPanel credentials and the latest backup will be ready the moment we start. If you have a solid track record cleaning hacked WordPress sites and tightening server security, I’m ready to move quickly.