Website Security & PHP Specialist | Azure, GoDaddy, Malware Detection & Vulnerability Assessment

We are seeking an experienced website security specialist with strong PHP expertise to assess and help secure multiple business websites hosted across different environments, including Microsoft Azure and GoDaddy. We operate several established business websites, including online education platforms that process customer registrations and payments. We want to ensure our websites, applications, hosting configurations, and associated systems are secure, properly maintained, and free from unauthorized access or malicious code. This is a security-focused engagement, not simply a website development or maintenance project. We are looking for someone who can independently investigate potential vulnerabilities, identify signs of compromise, explain risks clearly, and provide practical recommendations for remediation. Initial Scope of Work 1. Website Security Assessment Review multiple PHP-based websites for common security vulnerabilities. Check for signs of malware, injected scripts, backdoors, unauthorized modifications, and suspicious files. Assess whether any websites show evidence of unauthorized access or compromise. Identify outdated or vulnerable PHP versions, libraries, plugins, frameworks, or third-party dependencies. Evaluate common application vulnerabilities, including SQL injection, cross-site scripting (XSS), insecure file uploads, and authentication weaknesses. Review file permissions, configuration files, and protection of sensitive credentials. 2. Hosting & Server Security Our websites are hosted in different environments, including Microsoft Azure and GoDaddy. We need someone experienced in reviewing security across both cloud infrastructure and traditional/shared hosting environments. Responsibilities may include: Reviewing applicable Azure App Service, storage, identity, access, and security configurations. Reviewing GoDaddy hosting configurations, website files, access controls, and available security settings. Identifying unnecessary administrative access, exposed services, or insecure configurations. Evaluating available logs for suspicious activity. Recommending appropriate security improvements for each hosting environment. 3. PHP Application Review Assess PHP application security and compatibility. Identify vulnerable or outdated code and dependencies. Review database connectivity, session management, authentication, and input handling. Recommend PHP updates or code changes where necessary. Identify security issues that could affect customer information or payment-related workflows. 4. Security Findings & Remediation Plan We expect a clear, actionable report identifying: Websites and systems reviewed. Confirmed security findings versus potential vulnerabilities requiring further investigation. Evidence of compromise, if discovered. Risk severity and business impact. Recommended corrective actions, prioritized by urgency. Estimated effort and cost to implement necessary fixes. If the initial assessment is successful, we may hire the same specialist for approved remediation and ongoing security maintenance. Required Qualifications Demonstrated professional experience in website and application security. Strong knowledge of PHP security and common web application vulnerabilities. Experience investigating compromised websites, malware, malicious redirects, backdoors, or unauthorized file changes. Familiarity with Microsoft Azure hosting and security. Experience with GoDaddy hosting, cPanel, Plesk, or comparable hosting environments. Understanding of OWASP security principles and secure coding practices. Experience reviewing access permissions, logs, and server configurations. Ability to provide clear documentation and communicate findings to a nontechnical business owner. Preferred Qualifications Experience securing websites that process registrations, customer information, or online payments. Experience with payment gateway security and PCI DSS considerations. Experience with incident response and malware remediation. Experience with both custom PHP applications and common content management systems. Familiarity with Cloudflare, WAF configurations, vulnerability scanning, and security monitoring. Initial Engagement & Budget Initial fixed-price assessment: $300 This budget is for an agreed-upon, limited initial security assessment and written findings report—not a guarantee of a complete audit of every website or full remediation. The initial scope, number of websites, and access requirements will be agreed upon before work begins. Additional security assessments, remediation, and ongoing maintenance may be contracted separately. We are interested in developing a long-term working relationship with a qualified, trustworthy specialist. Security & Confidentiality Requirements Because these are active business websites, security and confidentiality are essential. Work must be performed only within an explicitly authorized scope. No destructive testing, unauthorized penetration testing, or changes to production systems without prior written approval. Initial access will be limited to the minimum permissions necessary. No downloading, copying, or retaining customer information, payment data, or confidential business information without explicit authorization. Findings and credentials must be handled confidentially. Any suspected active compromise or critical vulnerability must be reported promptly. All work must be documented, and no changes may be made without approval. Questions for Applicants Please answer the following questions in your proposal: Describe a real project where you investigated a potentially compromised PHP website. What did you discover, and how did you resolve it? What experience do you have securing websites hosted on both Microsoft Azure and GoDaddy or similar hosting providers? How would you determine whether a website has already been compromised, rather than simply identifying potential vulnerabilities? What tools and methods would you use for an initial security assessment, and what access would you require? What could you realistically evaluate and deliver within an initial $300 fixed-price engagement? Are you available for additional remediation work if vulnerabilities or evidence of compromise are discovered? Please provide examples of relevant security projects. Generic website development experience alone is not sufficient. We value technical expertise, independent problem-solving, clear communication, discretion, and a proactive approach to security.