Code, not templates
I review and write PHP directly when needed — I don't rely on a plugin already having the fix.
WordPress Developer · WooCommerce · Security
WordPress expert and web developer for demanding projects
I'm Javier Afán, a WordPress developer with more than ten years building and optimising business websites and online stores. I take control when your site goes down, gets hacked, starts throwing errors, or needs something no plugin can fix. I only handle the technical side — development, incidents, security, and maintenance.
More than 10 years with WordPress
Technical work, no salesperson involved
You talk directly with me
What I can help you with
WordPress development, security, and technical support
WordPress emergencies and technical support
Your site is down, throwing an error, or something isn't working. I run diagnostics up front and step straight into the code, the database, or the server configuration.
WordPress security and disinfection
I detect and remove malware by hand, close the entry point, and harden the site so it doesn't happen again.
WordPress security audit
A review under the OWASP methodology to assess access, permissions, forms, server configuration, and business logic, documenting every vulnerability.
WordPress maintenance
Total technical peace of mind. Tested updates, verified backups, and continuous security monitoring, month after month.
My differentiator
Hardening and security for your website
Traditional WordPress development is satisfied once the site works correctly and looks good. My work covers the invisible layer almost nobody accounts for until it's too late: hardening and security in WordPress. I lock down the site at a technical level to drastically reduce the attack surface through strict permissions, blocking known entry points, and full access control. WordPress powers over 43% of the websites on the internet, and that same popularity makes it a constant target. Developing for WordPress without factoring this in is leaving the door half open to unwanted visitors.
It's not that I build sites and also happen to know security. It's that I build with security in mind from the very first line.
How I work
I work on the structure that holds up your website
Database
A lot of configuration errors and infections stay hidden inside the database.
Server and configuration
File permission control, HTTP headers, and PHP configuration decide whether a vulnerability stays a scare or becomes a disaster.
Online store
Payments, orders, and integrations are the part of an online store that can't afford to fail.
Scope
Web development focused on WordPress and security
Even though my technical experience would let me offer design or marketing, I prefer absolute specialisation. I focus all my technical capacity exclusively on the WordPress core, because that's where I make a real difference with custom development, advanced security, and proactive maintenance.
Build custom functionality in PHP
Fix sites that are down or throwing errors
Remove malware and close the entry point
Apply hardening and strengthen security
Audit following the OWASP methodology
Technical maintenance and controlled updates
Web design with templates and visual builders
Social media management
Advertising campaigns
Content writing
Why I specialised in this
WordPress developer specialised in security
WordPress lets you build a working site without writing a single line of code, and that explains why it's the most widely used platform on the internet. What the system doesn't solve automatically is what happens afterwards, because nobody warns you what to do when something breaks, when an update turns out to be dangerous applied blindly, or how to spot a vulnerability. That's the field I've specialised in as a web developer. I review and analyse WordPress sites, understand their structure, and fix problems at the root, working on the code, the database, or the server configuration. I apply security measures from minute one, not as an afterthought patch. That's the real line between writing an arbitrary function and building a solution that blocks new threats from getting in.
Already know what's wrong with your site?
Describe the problem and I'll tell you if I can help and where I'd start.
Who I work with
Sectors where I have the most experience
I work with any business that needs a technical WordPress solution. These are the profiles I run into most often:
Companies with a corporate website
Forms, service pages, and an online presence that needs to always be up and running.
Online stores running WooCommerce
Where a checkout or catalogue failure translates directly into lost sales.
Sites with a long technical history
Projects that have passed through several hands and have accumulated patches, abandoned plugins, or undocumented decisions.
Businesses without their own technical team
That need a WordPress expert to turn to when something goes beyond their own knowledge.
How I work
How a WordPress expert works
01
I look at what's going on before touching anything
I check the code, the database, or the configuration depending on the case, and understand what's there before changing a single line.
02
I fix it and tell you what it was
I fix, clean, reinforce, or audit depending on the case, touching no more than necessary and no less than needed.
03
I check it works and put it in writing
What I found, what I changed, and what's worth keeping an eye on from now on, in plain language.
Who I am
I'm Javier Afan, a WordPress developer specialised in security
I've spent over 10 years working with WordPress at marketing and development agencies, coding in PHP and gradually specialising in security — hardening, disinfecting compromised sites, and auditing under the OWASP methodology. When you write to me, you talk to me directly, no tickets and no account managers in between. The person who reviews your site is the same person who fixes it and the same person who explains what happened.
When you write to me, you talk to me. There's no salesperson or middleman, nobody who hands off the quote to someone else. The person who reviews your site, the person who fixes it, and the person who explains it are the same one.
Years of agency experience with WordPress and PHP
Specialised in security and hardening, not just development
Audits following the OWASP methodology
You always talk to me directly
80%
of severe slowness issues on these installations come down to poor server configuration or an excessive accumulation of plugins.
~50%
of WordPress sites are affected by a vulnerability in an outdated plugin or theme.
30%
of critical errors happen right at the moment an incompatible update is applied.
Contact
Let's talk about your site
Briefly describe the technical problem or the project you have in mind. I'll reply within 24 working hours with an initial assessment.
Before you write to me
Don't worry if you can't describe the fault in technical terms
Just tell me if you're seeing an error or if the site won't load, and I'll take it from there. I'll find the problem from the inside.
Frequently asked questions
Before you write to me
What people usually ask before hiring me
What's the difference between a WordPress expert and someone who just builds websites?
Building a site with themes and plugins is a widespread, practical way to put together WordPress pages. The technical complexity shows up when something breaks and you need to review the code, the database, or the server to restore stability or functionality. That's where a technical profile makes the difference, solving problems that visual tools can't.
You didn't build my website. Can you still work on it?
Yes, and it's actually the most common case. Most of the sites I fix were built by someone else, or by an agency that no longer exists. The first thing I do is review it to understand how it's put together before changing anything.
Do you also do web design or marketing, on top of development?
My service as a WordPress developer focuses solely and exclusively on the technical infrastructure. I don't offer marketing campaigns or web design. By hyper-specialising in WordPress at a technical level, I guarantee real solutions in custom development, protection against attacks, and high-performance maintenance. That said, if you need those services, I can put you in touch with companies that do very good work in those areas.
When is the right time to hire a WordPress developer?
That moment usually arrives when your site stops being a simple showcase and needs complex features that standard plugins can't handle. If you're hitting technical bottlenecks, need to connect your platform to external software, or are after custom workflows, that's where I step in to build the right solution for your business.
Do you take on complex projects built by other developers?
Absolutely! A large part of my day-to-day is stepping into WordPress sites that are already running but have technical limits or underlying bugs. I analyse the inherited architecture, fix deficiencies or code-level errors, and stabilise the environment so you can keep scaling your business on a solid technical foundation.
Do you build custom features that don't exist in the official repository?
That's the main advantage of working with a technical expert. If your business processes need a specific tool and nothing on the market fits exactly, I build that feature from scratch. I integrate it natively into your WordPress so it runs lightweight, secure, and without third-party dependencies.
What do you do if my site throws technical errors and nobody knows where they're coming from?
When visual tools don't reveal the source of a fault, you need a WordPress expert who can check it at server level. Tracing error logs and analysing the internal code lets me pinpoint the exact conflict so I can apply a definitive technical fix.
Can you scale a site that's outgrown my business's volume?
As a web developer, I take on scaling projects that can no longer handle their current traffic or sales volume. I analyse the entire technical architecture of WordPress and optimise database queries so it can absorb your real growth without hitting bottlenecks or performance issues.
Do you audit code on projects that are already live?
Reviewing the code of a live site helps uncover hidden bad practices or security and compatibility issues. I go through the WordPress files looking for obsolete functions, security flaws, or junk code that overloads the server. The goal is to clean up the technical foundation so the project can grow without dragging old errors along.
Do you build custom themes if I don't want to use visual builders?
I develop WordPress themes from scratch, working directly in PHP to guarantee flawless technical performance (the same way I built my own site). Avoiding heavy builders keeps the code clean and the page loading at full speed without depending on external add-ons that slow down the server.
Do you work directly on the live site, or do you need to clone it first?
I never test anything on a WordPress site that's receiving visitors or generating sales. I first create an exact copy of the site in a closed, secure environment to work on with total freedom. Once the new code is finished and checked down to the last detail, I apply the changes to your live site so your customers and visitors don't notice any interruption in service.
A site that's down costs more than fixing it
If your WordPress is down, running slow, or has been infected with malware, the sooner I look at it, the less impact it will have.