WordPress/PHP Developer Needed to Secure Existing Serial Number Lookup

We’re looking for an experienced WordPress/PHP developer to secure an existing custom serial number lookup tool on our WordPress website. The tool allows customers to look up product manuals using a serial number or product identifier. We recently discovered that the lookup could be automated to systematically retrieve a large amount of our serial history. We need a developer to address this vulnerability while preserving the tool’s existing functionality and data structure. WHAT WE NEED • Implement rate limiting: Target limits of 3 searches per minute, 10 per hour, and 20 per rolling 24-hour period. • Add IP whitelisting and blacklisting: Trusted IPs should bypass rate limits, and blacklisted IPs should be blocked. We need clear instructions for managing both lists. We do not yet have a blacklist, but may implement in the future. • Enforce limits before database queries: Make sure rate limits happen before the database lookup, so blocked requests can't continue querying the database. • Display an appropriate error message or page when a request is blocked or a rate limit is exceeded. • Review the existing PHP code for obvious security and performance improvements related to this tool. • Review the manual directory for obvious exposure risks that could allow unauthorized access to files. • Preserve all existing functionality, including valid alphanumeric identifiers. For example, 1IRC must continue to return the correct manual. • Test thoroughly on staging before any production changes are made. IMPORTANT PROJECT REQUIREMENTS • Work with the existing implementation. We are looking to secure the current lookup, not replace it with a new system. • Preserve the existing database and data-update process. Do not replace, rebuild, or reimport the serial database or change how its data is maintained without discussing the reason with us and receiving approval first. • Keep changes focused and explainable. We want to understand what was changed, where it was changed, and how it addresses the vulnerability. The website is hosted on SiteGround. We can provide other relevant files or access needed to assess the current implementation. DELIVERABLES Before implementation, please briefly explain your proposed approach and identify any additional files or access you need. Upon completion, we expect: • Thoroughly tested on staging, with confirmation that the existing lookup functionality still works. • Confirmation that blocked requests are stopped before the database lookup executes. • A summary of the files and database components changed. • Test results covering rate limits, whitelisted and blacklisted IPs, and valid serial/model lookups. • Clear instructions for managing the whitelist and blacklist. PLEASE INCLUDE IN YOUR PROPOSAL • Your estimated hours and total cost. • Any questions or concerns you would want to resolve before beginning. • What specific access you would need for all of the above. We’re not looking for a complete website rebuild or a large-scale security audit. This is a focused fix to an existing tool, and we value a careful, transparent approach that protects our data without disrupting the current system. If you've worked with custom WordPress plugins and understand the difference between blocking the request before the database query vs. simply hiding the result, that's especially relevant. Thank you!