Looking for security / performance experts

...

Paul.

Thank you for the kind advice Paul, I really appreciate the time you put into it.

My conclusion is:

• I will do as you said about code, clean output and validate input, best practices I find online.
  
• Then I hide the server behind CloudFlare, use anonymous SMTP servers to hide server IP in outgoing emails sources. (they can't attack the server directly if they have no idea what is the IP address and the DNS/Website is protected by cloudflare)
  
• And finally use CloudFlare WAF to help protect sensitive pages.
  

But in the meanwhile I also found this website:
https://www.codementor.io/php-experts

They are asking for $10-$30 for a 15 minute session, will try them a few times if I really get stuck.

Thanks again.