Security Hardening & Performance Optimization

Context

Functional, but technically exposed.

A professional services firm — architecture and construction — running a WordPress site that was functional but technically exposed. The site was being used as a credential and lead generation tool, meaning its security and credibility directly affected the business.

Problem

Credibility at risk, before any traffic even mattered.

SSL Labs grade was not at A. Security headers were completely absent — grade D. For a firm selling professional credibility, a security audit that exposed these gaps would undermine client trust. Beyond perception, the missing headers left the site exposed to clickjacking, MIME sniffing, and cross-site scripting vectors.

Diagnosis

Security and performance, audited together.

Security audit covering SSL configuration, HTTP response headers, Wordfence status, and WordPress hardening checklist. Performance audit via PageSpeed Insights, GTmetrix, and Chrome DevTools.

Key findings:

• SSL configuration not at A — cipher suite issues
• 5 critical HTTP security headers missing: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• PageSpeed mobile at 66 — render-blocking resources, unoptimized images
• No caching layer active

Constraints

What the work had to fit around.

• Live site with active client inquiries — no downtime window
• No staging environment
• Client unfamiliar with technical changes — documentation required

Implementation

SSL, headers, and performance — in that order.

SSL hardened via Cloudflare — TLS configuration updated, HSTS enabled, cipher suites corrected. Grade confirmed via SSL Labs.

HTTP security headers implemented via Cloudflare Rules — all 5 missing headers added and validated via Security Headers tool. Grade D → A.

Performance optimization: WP Rocket installed, caching configured, render-blocking resources deferred, images compressed and converted to WebP format.

Tradeoffs

HSTS only after SSL was fully validated.

Implementing HSTS requires confidence that SSL is correctly configured — enabling it on a misconfigured SSL setup can lock users out. SSL was fully validated before HSTS was activated.

Stack

Before / After

Five numbers, before and after.

GTmetrix Grade B · Performance 75% · LCP 2.2s · CLS 0 · May 2026

SSL Labs Grade A · 4 servers · May 2026

PageSpeed Desktop 86 · Accessibility 85 · LCP 1.8s · May 2026

Outcome

Secured, hardened, and documented.

Site secured and hardened. SSL at A, all critical security headers in place. Desktop performance improved significantly. Client delivered a documented security baseline.

Lessons

The most overlooked quick win in WordPress.

Security headers are the most overlooked quick win in WordPress. They're invisible to the end user, rarely checked by site owners, and fixable in under an hour via Cloudflare — yet their absence leaves sites exposed to vectors that are trivially easy to exploit.