Closing a critical, publicly-known vulnerability on a live booking site, with zero downtime.
A Bristol hospitality business taking online bookings was running on shared WordPress hosting that looked fine but was quietly exposed. A previous web agency still held access to the hosting account and its DNS, the site’s page builder carried a critical remote code execution flaw rated 9.9 out of 10, the core software had gone without security updates since 2022, and basic email and web-security protections were missing.
We audited the site read-only, then remediated everything on a staging copy before going live, with backups and rollback in place. We removed the leftover third-party access, patched the critical flaws and updated every plugin, upgraded the core software to a current supported version, added SPF, DKIM and DMARC across both domains, and applied standard web-security headers. We also confirmed the site was clean, with no malware and no unauthorised administrators.
The site went from carrying a critical, publicly known vulnerability and unsupported software to fully patched, upgraded and protected, with no downtime and no disruption to bookings. The kind of exposure attackers scan for automatically was closed before it could be used.
Whether it is security, hosting, compliance or a site that is misbehaving, we will take a look and tell you straight.
Get in touch