01
Context
Esthetic Dubai brings in patients through its WordPress site: visitors arriving from ad campaigns land on service pages for implants, orthodontics, veneers and whitening, and Fluent Forms captures their enquiries. OLDEV originally built the site. It was then maintained elsewhere for a period and came back in an unknown state: 48 plugins installed, 16 updates pending, 11 forms, a second administrator account to account for, and no scheduled backups or uptime monitoring.
The engagement treated the returning site as untrusted ground. A full backup came first, then an audit with prioritized findings and a list of decisions for the client, then a first remediation phase covering security, updates, performance, backups and monitoring. Every result was checked from outside the site, with an external security scanner, PageSpeed Insights and direct HTTP requests, before the site moved into a monthly maintenance rhythm. The next phases, for heavier performance work and email deliverability, were scoped from what the remediation uncovered.
02
The Challenge
- The site had been in other hands, so nothing could be assumed: admin accounts, injected code and core file integrity all had to be checked before any change.
- An external security scan graded the site 62/100 (C) with 11 issues, including an unprotected login page, open XML-RPC, user enumeration through the REST API and only 1 of 6 HTTP security headers.
- Mobile first visits scored 40/100 in lab tests, with the main content appearing after 9.6 s, driven largely by about 90 MB of uncached homepage video.
- Plugin sprawl: 48 installed and 36 active, with overlapping page-builder addon packs, chat and timeline plugins, and an active file-manager plugin, a known attack target.
- The lead forms submitted correctly, but their notifications were landing in spam, which only surfaced once each live form was tested end to end.
03
Scope and Approach
Backup, then audit
A full WPvivid backup stored off-site before anything was touched. The audit then covered versions, hosting, plugins, forms, accounts, an external security scan and PageSpeed on mobile and desktop. The client received a French report with 15 findings ranked by priority, an action plan ordered quick wins first, and five decisions only the client could make, such as the second admin account and translation.
Security hardening
Wordfence installed and configured: firewall, brute-force and login rate limiting, two-factor authentication, user-enumeration blocking. A WPCode snippet filters XML-RPC and hides the WordPress generator, server rules add the six HTTP security headers, the PHP version header was switched off, the login URL was moved, and XML-RPC plus default readme and license files were blocked outright.
Updates and plugin cleanup
All pending plugin updates applied, WooCommerce included, with every page checked for a 200 response and no fatal errors afterwards. The file-manager plugin and two developer tools left on the live site were deleted. A bundled slider plugin with a known vulnerability and no license was proven unused and removed rather than updated.
Performance tuning
LiteSpeed configured for CSS and HTML minification, CSS combining, font-display swap, lazy-loading of images and iframes, and missing image dimensions, which corrected layout shift. Images converted to WebP through the image service only, without moving the site onto a CDN. Each setting was kept or reverted on PageSpeed evidence.
Backups, monitoring and final sweep
Weekly full backups to off-site storage with four kept, and a five-minute keyword uptime monitor. A post-remediation sweep crawled 14 live pages, checked every internal link and grepped every page for insecure resources. The client received a before and after report listing what was done, what was deliberately left alone, and what the work uncovered.
04
Architecture flow
05
Technical Deep Dive
Hardening verified from outside
Every change was confirmed the way an attacker would see it: HTTP requests for the six headers, the missing PHP version header, and 403 responses on XML-RPC, readme and license files, then a full re-scan. Three minor scanner flags remain on purpose, because closing them would break site features. The mixed-content flag traced to a single theme metadata link, not a loaded resource.
What the host allowed, and what it did not
JavaScript combining and deferral both raised Total Blocking Time in testing, so both stay off; lab blocking time also varied widely between runs, so single runs were not chased. Browser caching for the homepage video could not be set from the site, because the host's edge cache overrides those rules. The video therefore moved to its own phase as a compression job.
Forms that captured but did not deliver
Of 11 forms, only 5 were live; 6 were duplicates or a demo. Live tests showed every notification landing in spam: WordPress was sending unauthenticated mail with no SPF, DKIM or DMARC alignment for that path. The forms worked; the delivery did not. The test also showed a key service page with no lead form at all, flagged to the client as a conversion gap.
06
Engineering Decisions
Remove before patching
The slider plugin carried a known vulnerability and had no license for updates. Rather than buy one, all 15 pages were crawled to check for any use of it. None was found, so it was deleted: the vulnerability went with it, at no cost and with nothing left to maintain.
Measure before keeping a setting
Common speed checklists switch every optimization on. Here each one was tested against PageSpeed, and the two that made blocking time worse were turned back off. The locked configuration was recorded so a later update or a different maintainer does not quietly re-enable them.
Defer what could break, in writing
Two items were left alone on purpose: a form plugin update with no license on hand, while the forms worked, and a console-only carousel error whose fix could cause side effects. Both were diagnosed, and both are disclosed in the client report with the reason and the condition for doing them.
07
Results
- External security score raised from 62/100 (grade C, 11 issues) to 98/100 (grade A), with the 3 remaining minor flags documented and left by choice.
- HTTP security headers from 1 of 6 to 6 of 6; WordPress and PHP versions hidden; XML-RPC, readme and license files returning 403, all confirmed with direct HTTP requests.
- Malware and core-integrity scan clean; pending plugin updates cut from 16 to 0 apart from two deliberately deferred, and an unused vulnerable plugin removed.
- Mobile lab performance score from 40 to 57, with desktop at 82 (84 before) and layout shift corrected.
- Weekly off-site backups and a five-minute uptime monitor in place, and 76 internal links checked with zero broken.
08
Planned next
- Homepage video compression, approved by the client, as the main lever for mobile load time, plus removal of the 6 duplicate forms and consolidation of overlapping plugins.
- Email deliverability: authenticated sending through FluentSMTP with SPF, DKIM and DMARC aligned, clearly named form notifications, and an auto-reply to each enquiry; a CRM is optional, pending client scope.
- A DNS record publishing the campaign landing pages, hosted on Vercel, on a subdomain of the clinic's domain without touching the site or email.
- Monthly maintenance: updates, security monitoring, backups, and form, link and functionality checks.