WordPress Security & Load Testing

I run the WordPress site you will be testing, and I have full authority to approve every step of the assessment, so you can concentrate on the work without red-tape worries.

Here’s what I need: attack the usual entry points—wp-login.php and xmlrpc.php—exactly as a real threat actor would. I want to know whether my rate-limiting, lockout rules and alerting actually stop a determined brute-force attempt, or whether they only look good on paper. While you’re there, confirm whether an outsider can enumerate valid usernames through author pages, the REST API or any sitemap quirks. If a password can be uncovered by systematic guessing, tell me how and how fast.

Once the login vector is covered, push the whole site with a realistic burst of concurrent traffic until you see performance dip or services fail. I’m after numbers here—requests per second, response-time thresholds, and the exact point where pages time-out or the server crashes.

Deliverables I expect
• A concise written report (no automated scanner dumps). Summarise each finding, rate its severity, and give an actionable fix a developer or sysadmin can implement.
• Clear evidence for every claim—screenshots, logs, or command outputs—enough that I can reproduce or verify the issue.
• A short debrief call or chat to walk me through the results, if anything is critical.

When you reply, let me know:
• Similar WordPress or web-app tests you’ve run.
• The primary tools you prefer (WPScan, Burp Suite, Hydra, JMeter, k6, etc.).
• How soon you can start and how long the whole exercise will take.
• Your fixed price for the entire scope above.

I’m ready to supply whatever access or staging details you need as soon as we agree on terms.