Security
$135/hr
Hardening + audits
Cybersecurity consulting is hands-on security work by the hour: security audits, WordPress hardening, log monitoring setup, SIEM configuration and compliance review. It’s $135 an hour, with a 2-hour minimum. I work in person around Worcester County, Boston and New England, and remotely for anyone else.
Who it’s for
- Businesses that need specific security work that doesn’t fit a fixed package
- Teams setting up monitoring and alerting for the first time
- Organizations answering a client’s or insurer’s security questionnaire
- Anyone who wants a second opinion after an incident
What we can work on
- Security audits of WordPress sites and servers
- WordPress hardening: logins, user roles, file permissions and server configuration
- Log monitoring setup, so attacks and failures show up somewhere you’ll see them
- SIEM configuration to collect and correlate security events
- Compliance review, including the Massachusetts Data Privacy Act
Experience behind it
I built a SIEM dashboard that watches 40 sites, a custom WordPress security plugin and the free PHP2Shell and wp2shell scanner, shipped the day after PHP2Shell went public. Further reading: Hardening WordPress for High-Risk Environments.
How hourly work is billed: invoiced every two weeks, or at the end for engagements under 10 hours. Prepaying for 20 or more hours takes 10% off the rate, and those hours stay valid for 90 days.
Fixed-price alternatives
If your needs match a package, it’s usually better value: Security Audit ($850), Hardening Package ($2,400), SIEM/SOC Setup or Hacked WordPress Site Repair.
Common engagements
- After a scare: a suspicious login, a warning from your host or a defaced page, checked properly so you know whether it’s over
- Before a launch: a new site or app reviewed and hardened before it goes public
- Questionnaires: help answering a client’s, partner’s or insurer’s security questions accurately
- Monitoring setup: logs and alerts set up so problems reach you instead of sitting unread on a server
What it costs
Cybersecurity consulting is $135 an hour with a 2-hour minimum. Prepaying for 20 or more hours takes 10% off, and those hours stay valid for 90 days. Common security work also has fixed prices, listed above.
How I compare
| Jeremy Anderson | Boston agency | Offshore freelancer | General freelancer | |
|---|---|---|---|---|
| Local Massachusetts presence | Yes | Yes | Remote only | Varies |
| WordPress, AI and security from one person | Yes | Separate specialists | Rarely | Rarely |
| 25+ years of experience | Yes | Depends on the team | Varies widely | Varies |
| Direct communication, no account manager | Yes | Account manager layer | Yes | Yes |
| Massachusetts privacy (MDPA) know-how | Yes | Some | No | No |
Working together
- A free 30-minute call about what you need. Book one here.
- A written estimate of the hours and what’s included, agreed before work starts.
- The work, with progress you can see and invoices every two weeks.
- Handoff: what was done, how it works and what to watch for next.
Packages and prices
- Security Audit: $850 · flat fee · delivered in 5 business days
- Hardening Package: $2,400 · flat fee · 1–2 week delivery
- MDPA Compliance Review: $675
- SIEM / SOC Setup: $4,500+ · scoped + quoted · 2–4 weeks
Security Audit
$850 · flat fee · delivered in 5 business days
A security audit tells you what’s at risk on your WordPress site and what to fix first, before an attacker finds it. It’s a flat $850, delivered in 5 business days, and ends with a written report and a call to walk through it. I work with businesses in Shrewsbury, Worcester, Boston and across New England, and remotely.
What I check
- Plugins and themes, scanned for known vulnerabilities
- User roles and permissions: who can do what, and who shouldn’t
- Login security and two-factor authentication
- SSL/TLS configuration
- File permissions and server configuration
What you get
- A written report with a risk rating for every finding and a clear fix order
- A 30-minute debrief call to go through the report and answer questions
The audit is a review. You can fix the findings yourself or with your current developer, or have me do it: the Hardening Package ($2,400) includes this audit and then implements the fixes.
Who it’s for
- You inherited a site and don’t know how it was built or maintained
- Your site collects customer information through forms or WooCommerce
- A plugin you use was in the news for a vulnerability
- You want a clear picture before deciding how much to spend on security
How it works
- You give me access to the site and, where possible, the hosting account.
- I scan and review everything in the checklist above.
- You receive the written report within 5 business days.
- We go through it together on a 30-minute debrief call.
Book a free call about Security Audit
Hardening Package
$2,400 · flat fee · 1–2 week delivery
The Hardening Package is the audit plus the fixes. I review your WordPress site, then implement everything on the list and document every change, so the site ends up measurably more secure and you know exactly what was done. It’s a flat $2,400 and takes 1 to 2 weeks.
What’s included
- The full Security Audit
- Hardening of WordPress core, plugins and themes
- Login protection and brute-force blocking
- Two-factor authentication setup
- Security headers and web application firewall (WAF) configuration
- Log monitoring setup, including fail2ban and audit logs
- A malware scan, with cleanup if anything is found
- A compliance checklist review
- Written documentation of every change
Who it’s for
Businesses whose site handles customer data, takes orders or bookings, or simply can’t afford to go down. It’s also the right next step after a cleanup, so the same hole doesn’t get used twice.
How it works
- Free 30-minute call. We talk through what you need and whether I’m the right fit.
- Written proposal. You get the scope, price and timeline in writing within 3 business days.
- Start. Work usually starts within 1 to 2 weeks of signing. Project work takes a 50% deposit, with the rest due on delivery.
- Delivery and support. You get the finished work, documentation of what changed, and the support period listed for your package.
Keeping it secure afterwards
Hardening is a point in time; plugins and threats keep changing. The Watchdog plan ($350 a month) covers updates, weekly uptime monitoring, offsite backups and a monthly security scan. Guardian ($850 a month) adds a 24-hour response time and a quarterly security report.
What this looks like in practice
For a research publisher, I built a custom security plugin that replaced a heavy security suite across their sites. Brute-force attempts are blocked at the login, and there have been no compromises since it was installed. The Hardening Package applies the same principles to your site using proven tools.
Background reading: Hardening WordPress for High-Risk Environments.
Book a free call about Hardening Package
MDPA Compliance Review
$675
An MDPA compliance review checks your WordPress site against the privacy expectations of the Massachusetts Data Privacy Act: cookie consent, data collected by your plugins, and how your site handles visitors’ personal information. It’s $675 and ends with a remediation checklist. I work in person around Worcester County, Boston and New England, and remotely for anyone else.
Why WordPress sites need a specific review
Most privacy problems on WordPress sites aren’t in the privacy policy. They’re in the plugins: analytics, forms, chat widgets and marketing tools that collect and send data in the background, often before a visitor agrees to anything. A general privacy template can’t see that. This review looks at what your site actually does.
What I review
- Cookie consent: whether your banner actually blocks tracking until a visitor agrees, and whether “reject” works as well as “accept”
- Plugin telemetry: which plugins collect or send data, and to whom
- Data handling: what your forms collect, where submissions are stored, who can see them and how long they’re kept
What you get
- A remediation checklist, in priority order, of what to change on the site
- Notes on which changes are quick settings and which need development work
This is a technical review of your website, not legal advice. Your attorney decides what the law requires of your business. I make sure the website does what you’ve decided it should.
Book a free call about MDPA Compliance Review
SIEM / SOC Setup
$4,500+ · scoped + quoted · 2–4 weeks
If you run several WordPress sites or web applications, problems are easy to miss because the warning signs are spread across different servers and logs. A SIEM/SOC setup brings them into one place, alerts on common attack patterns and gives non-technical staff a dashboard they can read. Projects start at $4,500 and usually take 2 to 4 weeks.
What’s included
- Architecture design for monitoring multiple sites
- A centralized logging pipeline
- Alert rules for common attack patterns
- AI-assisted log analysis
- Uptime and availability monitoring
- An incident response runbook
- A dashboard for non-technical staff
- 60 days of support and tuning
Who it’s for
Agencies, publishers and organizations managing many sites on shared or distributed infrastructure, especially when no one is watching the logs today.
How it works
- Free 30-minute call. We talk through what you need and whether I’m the right fit.
- Written proposal. You get the scope, price and timeline in writing within 3 business days.
- Start. Work usually starts within 1 to 2 weeks of signing. Project work takes a 50% deposit, with the rest due on delivery.
- Delivery and support. You get the finished work, documentation of what changed, and the support period listed for your package.
What this looks like in practice
I run this kind of setup myself. My SIEM/SOC dashboard watches about 40 WordPress sites across 6 servers. When a brute-force run from one IP range hit several client sites at once, it showed up as one correlated event instead of a pile of separate emails, and the range was blocked across the fleet within the hour. Daily checks went from about an hour to a 10-minute review.
Background reading: Building an AI-Assisted Cybersecurity Monitor.
Book a free call about SIEM / SOC Setup
Common questions
How much does cybersecurity consulting cost?
$135 an hour, with a 2-hour minimum.
My site is hacked right now. Is this the right service?
Start with Hacked WordPress Site Repair, which begins with a free assessment.
Do you work on servers, or only WordPress?
Both. Log monitoring and SIEM work happen at the server level.
Isn’t a security plugin enough?
A good plugin helps, but it can’t fix weak passwords, outdated server software or an admin account nobody remembers creating. Consulting covers what a plugin can’t see.
Do you need access to our server?
For log monitoring and SIEM work, yes. For a WordPress-only review, admin access to the site is usually enough to start.
Is my site at risk from PHP2Shell?
If your server’s PHP wasn’t updated after October 21, 2026, it may be. My free scanner checks in about two minutes.
I already have a security plugin. Do I still need this?
A plugin covers some of these checks. The audit also looks at the parts a plugin can’t see well, like who has admin access, server configuration and file permissions, and ranks everything by risk.
What if you find malware?
I’ll tell you right away. Cleanup is part of the Hardening Package, or see hacked site repair if the site is actively compromised.
Do you meet in person?
Yes. For clients in Greater Boston and the Worcester area, discovery sessions and kickoff meetings can be in person, and there is no travel surcharge within 50 miles of Shrewsbury. Ongoing work is usually remote.
How much does a WordPress security audit cost?
$850 flat, delivered in 5 business days.
How often should a site be audited?
At least once a year, and after any major change. The Partner retainer includes a full security audit every quarter.
How is this different from the Security Audit?
The audit tells you what to fix. The Hardening Package includes the same audit, then fixes everything on the list and documents each change.
Can you work with my host?
Yes. Some settings live in WordPress and some at the server or host level; the audit shows which, and I’ll work with your host where needed.
How much does WordPress hardening cost?
$2,400 flat, delivered in 1 to 2 weeks. It includes a full security audit.
Is a security audit included?
Yes. The full Security Audit, $850 on its own, is part of the package, so the hardening starts from a written list of what’s at risk.
How much does an MDPA compliance review cost?
$675, including the remediation checklist.
Is this legal advice?
No. It’s a technical review of what your website does with personal data. Use it alongside advice from your attorney.
Can you make the fixes?
Yes. Many are settings changes. Anything that needs development is billed at my hourly rate or quoted up front.
Do we need a security team to use it?
No. The dashboard and runbook are written for non-technical staff, and the alert rules are tuned during the 60-day support period so you aren’t flooded with noise.
How is the price set?
It depends on how many sites and servers are involved. You get a fixed quote after the discovery call.
How much does a SIEM/SOC setup cost?
From $4,500, scoped and quoted for your environment, usually delivered in 2 to 4 weeks.
What happens when an alert fires?
The setup includes an incident response runbook, so whoever gets the alert knows what to check and what to do first.
Can you monitor it for us afterward?
Yes. Security monitoring is part of the retainers, from Watchdog up to Embedded Dev.
Book a free 30-minute call to talk it through, or email info@jeremyanderson.tech.