Applied
Engineering
Results
samuel-torres.com
Role
Web development, cybersecurity & infrastructure (QA → production), Microsoft 365 integration and ongoing maintenance.
Core stack
WordPress · Elementor Pro · Polylang (ES/EN) · Linux · Apache · PHP-FPM · MySQL · Microsoft Graph API / Entra ID · Wordfence · TLS/OWASP hardening
Context
Esentia Energy Systems is a Mexican energy-sector company. Its new corporate and institutional website — press releases, regulatory investor documents and annual reports — had to meet real enterprise standards: the client's Information Security team audited the site and made production launch conditional on closing every finding.
What I did
The initial audit found no security headers, weak ciphers and no Perfect Forward Secrecy. I configured OWASP security headers at the server level (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Secure/HttpOnly cookies) and modern cipher suites with PFS, mitigating clickjacking, XSS, MitM and downgrade attacks (POODLE, FREAK, Logjam, SWEET32). The InfoSec retest certified an A+ rating.
The server keeps port 80 permanently blocked by policy (HTTPS-only), which broke HTTP certificate validation; I solved issuance through DNS validation coordinated with the client's infrastructure team, without exposing the server.
Built and tested on a dedicated QA subdomain, then ran a coordinated low-traffic change window with a DNS switch to the production IP, fixed residual redirects to the test environment and regenerated Elementor assets. I closed the migration with a server-health technical report (load, RAM, swap and CPU for Apache, PHP-FPM and MySQL) as stability evidence for the client.
With basic SMTP authentication deprecated by Microsoft, I implemented form email delivery through the Microsoft Graph API using the client's Entra ID tenant, ensuring reliable corporate notifications.
Forms that adapt to each user type, and a bilingual ES/EN architecture with Polylang + Connect Polylang for Elementor, including content-QA cycles with the client to keep language and links consistent across both versions.
Press-release section, regulatory documents and annual reports with a flipbook viewer (FlowPaper), interactive images (Draw Attention), sanitized SVG uploads (Safe SVG) and technical SEO with Yoast.
Post-launch findings closed within the agreed SLA (low-severity vulnerabilities resolved in under 5 days), Wordfence monitoring (the site has withstood multiple reported attack attempts), automated backups (UpdraftPlus) and ongoing maintenance: plugin and PHP version updates with functional verification, always tested first on the QA environment.
Result
A stable production site with an A+ security rating, formal sign-off from the client's Information Security team, and congratulations from client leadership on the design and delivery.
Evidence from the live site
Screenshots from the production site and admin, showing the bilingual navigation, investor-relations functionality and dynamic forms described above.
The largest private interconnected natural-gas network in Mexico — company context for the audited site.
Bilingual navigation (Esp/Eng) across Energy, Gas, Sustainability, Investors, Clients and News sections — point 5.
Investor-relations hub: stock performance, relevant events and financial information — point 6.
FlowPaper flipbook viewer for regulatory documents and annual reports — point 6.
Gas-supply request form — a distinct field set per user type — point 5.
Press-release archive covering bond issuances, earnings and expansion announcements — point 6.
Short version (portfolio card)
Hardened to an A+ TLS/OWASP rating, this bilingual corporate website for an energy-sector company runs a QA → production pipeline with DNS cutover, form delivery via Microsoft Graph API (Entra ID), and security-monitored maintenance — audited and approved by the client's InfoSec team.
Resume / LinkedIn bullets
- Hardened an energy-sector corporate website to an A+ SSL rating (OWASP headers, PFS, modern ciphers), passing the client InfoSec team's audits.
- Executed the QA → production migration with a coordinated DNS change window, post-migration verification and a server-health technical report (Apache, PHP-FPM, MySQL).
- Integrated form email delivery via the Microsoft Graph API after basic SMTP deprecation, and maintain the bilingual site (Polylang) with Wordfence monitoring, backups and controlled PHP/plugin updates.