Website security and speed optimisation
that holds up under traffic

Both, usually on the same engagement, because the underlying audit covers both areas and the technical fixes overlap. A security audit examines server hardening, plugin and core vulnerabilities, file permissions, database access patterns, and existing malware traces. A speed audit examines Core Web Vitals (FCP, LCP, CLS, INP), JavaScript and CSS budgets, image optimisation, caching layer effectiveness, and CDN setup. A lot of issues surface from one audit that affect the other (an unpatched plugin can be both a security risk and a performance drag), so addressing them together is more efficient than two separate projects.

You can also scope work narrower if only one side is the problem: malware removal as an emergency response without a full speed audit, or a Core Web Vitals project without security work if security was recently audited elsewhere. Pricing reflects the actual scope. Ongoing maintenance work covers the upkeep after the initial engagement.

Both options are available. One-time projects typically run two to six weeks: audit, prioritised fix plan, implementation, verification, handover documentation. The site lands in a known-good state and you decide whether to keep maintaining that state yourself, hire someone else for it, or move to ongoing service with Studio Ubique. One-time fits sites that have hit a specific problem and want to fix it cleanly.

Ongoing service runs monthly through one of our website support packages (Care, Growth, Partnership), which cover continuous patching, monitoring, periodic re-audits, and response time targets when something needs fast attention. Ongoing fits sites where security and performance are continuous concerns (eCommerce, regulated industries, SaaS, high-traffic content). Website support packages cover what’s included in each tier.

No, security and speed optimisation work runs on whatever hosting you’re on: shared hosting elsewhere, VPS, dedicated, cloud platforms (AWS, GCP, Azure, Cloudflare R2), managed WordPress hosts (WP Engine, Kinsta, SiteGround), or platform-managed (Shopify, Webflow). The fixes apply at different layers depending on what we have access to. On hosting we don’t manage, we coordinate with your provider for the changes that need server-level access.

Where Studio Ubique hosting comes in: some optimisations require server-level configuration (LiteSpeed cache tuning, ModSecurity rules, account-level isolation) that’s only possible when we control the server. If those optimisations end up being the bottleneck for your specific case, the conversation usually shifts toward whether moving to our hosting makes sense. Not required, just sometimes practical. Our managed VPS hosting covers what server-level work looks like when we control the infrastructure.

Step one: contact us with whatever you’ve observed (site defacement, malicious redirects, Google’s “this site may be hacked” warning, customer reports, unusual server load, suspicious admin accounts). Step two, within hours: initial assessment, isolation if the breach is still active (temporary maintenance mode, password resets, blocking suspicious IP ranges), and a snapshot of the current state so we know what we’re working with. Step three, within days: full malware scan, removal of malicious files and database injections, identification of the entry point, hardening to prevent recurrence.

Cost depends on what we find. Simple infections (a single compromised theme or plugin, common malware variants) usually resolve in two to five business days. Complex breaches (backdoors, persistent attackers, customer data potentially exposed) take longer and may involve coordinating with legal and compliance teams. For active emergencies, contact us directly with “security emergency” in the message so it gets routed for fast response.

Measurement uses three tools in combination: Google PageSpeed Insights (lab data plus field data from CrUX), WebPageTest (controlled tests from specific locations and connection profiles), and Chrome User Experience Report (real-user data over 28-day windows). The before-audit baseline gets documented across all three, the after-implementation results get measured the same way at the same locations, and the comparison is the deliverable.

Typical before-and-after on WordPress sites that haven’t been optimised before: PageSpeed mobile score moves from 30-50 to 80-95, LCP drops from 4-6 seconds to 1.5-2.5 seconds, total page size drops 40-70%, and first-byte time drops from 800-1500ms to under 400ms. Sites already partially optimised see smaller jumps. Some sites have ceilings imposed by their stack (specific plugins, heavy custom JavaScript, third-party scripts) that we identify upfront so you don’t pay for unrealistic targets. Recent project work includes performance-focused engagements with before-and-after numbers.

Quick wins land in the first one to two weeks: cache configuration, image compression, CDN setup, removing the most expensive scripts, applying available security patches. These typically deliver 50 to 70% of the eventual gain. Deeper work runs over the next two to four weeks: theme and template optimisation, database cleanup, plugin rationalisation (replacing heavy plugins with lighter alternatives), custom code review where applicable.

Total engagement timing depends on starting state and scope: a sub-50 PageSpeed score on a moderately complex WordPress site usually completes in three to six weeks. A custom-built site with specific framework constraints can take longer because the work is more bespoke. Re-measurement and tuning runs through the engagement, not just at the end, so you see incremental progress rather than waiting for a final reveal. Pricing and rates page covers the rate structure for project work.

Studio Ubique builds the technical controls that compliance frameworks expect: access management, audit logging, encryption at rest and in transit, vulnerability management, incident response procedures, backup and recovery testing, and documentation of all the above. Where you’re pursuing certification (ISO 27001, PCI-DSS, SOC 2 Type I or Type II, HIPAA aligned for US clients), our work covers the website and infrastructure portion of what the auditors examine.

What we don’t do: the actual certification audit (that’s the certifying body’s role), policy authoring beyond technical scope, or organisational controls outside the website (HR, vendor management, training records). Those typically go through compliance consultants who specialise in the framework. We coordinate with them and provide the technical evidence auditors need. Discovery call for compliance-specific projects so we can confirm scope before estimating.