Web Security
I deal with web security where the real problems tend to be: in custom code, in outdated dependencies and in configuration. I am a cybersecurity and ethical hacking enthusiast, and I bring that mindset to every site I work on.
Fixing vulnerabilities
Got a vulnerability notice, or did a scanner or an auditor find one? I verify whether it can be exploited on your site, fix it in the code or with an update, and add a check so the same bug does not come back. That applies to Drupal and Hugo as well as to sites I did not build.
Fixing a hacked website
Is the site redirecting to strange pages, sending spam, or full of files nobody put there? I fix hacked websites whether they run on Drupal, WordPress or anything else. The process – isolation, analysis, cleanup, patching and prevention – is described on the Hacked Website Repair page.
Security code review
A review of custom modules, themes and applications focused on what actually gets exploited:
- XSS, SQL injection and CSRF
- access control – who may see and change what, including anonymous visitors
- input handling, file uploads, and how passwords and keys are handled
- vulnerabilities in dependencies (Composer, npm)
It includes static analysis, which I then leave running in CI so it checks every later change.
OWASP ASVS audit
OWASP ASVS is a verification standard for web application security. I go through your site or application against it – authentication, session management, access control, input validation, data protection and configuration. You get a list of findings ordered by severity, with recommendations and an effort estimate. What you fix and when is up to you; I can do the fixes straight away.
Apps written with AI
Did an AI agent write your app, and do you want to know whether it is secure and can keep growing? The security and best practice audit for such apps is on the Vibe-Coded App Review page.
What I focus on
I work with the site’s code and configuration. Infrastructure penetration testing and round-the-clock security monitoring are not part of what I offer – ongoing care with patches and backups is described under Website Maintenance .
Frequently Asked Questions
Will you fix a site you did not build?
Yes. For a vulnerability fix or a hacked site it does not matter who built it or what it runs on.
Do we need to be on Drupal?
No. I do code reviews and ASVS audits for other PHP, Python or Node.js applications too, and I clean up hacked sites on any platform.
I find and fix what an attacker could exploit – before they get the chance. Contact me on LinkedIn or use the form below.