Project context
The setting
A professional services organisation needed eight related WordPress websites investigated and restored after a coordinated compromise. Identifying details remain confidential.
Challenge
The problem to solve
The incident included malicious code, a plugin-related backdoor, unauthorised administrator accounts, redirects, spam activity, suspicious files, and database entries requiring investigation.
My role and scope
What I was responsible for
I led the WordPress investigation and cleanup across the affected sites, removed identified persistence mechanisms, verified the restored environments, and monitored them after recovery.
Investigation and reasoning
- Inspected WordPress files and database entries manually and with malware scans
- Traced a plugin-related backdoor and persistent infection behaviour
- Reviewed administrator accounts, redirects, spam activity, and suspicious files
Approach and implementation
- Removed malicious files, code, database entries, and unauthorised administrators
- Cleaned redirects and spam artefacts
- Ran post-cleanup scans and manual checks across all eight websites
- Continued monitoring for approximately 50 days
Measured Results
Verified Results & Performance Data
Quantitative before-and-after improvements and documented outcomes recorded during the project scope.
The project record documents eight websites cleaned and restored within four days. Follow-up scans during approximately 50 days of monitoring reported no malware detected. This monitoring period is not a guarantee against future reinfection.
- Sites restored
- 8
- Cleanup period
- 4 days
- Follow-up monitoring
- ~50 days
Evidence note
Project cleanup record and follow-up malware scan record. Exact calendar dates and publishable screenshots are not recorded in the portfolio data.
Constraints and lessons
What this work made clear
- Removing visible malware is not enough when persistence mechanisms remain
- Account, file, database, and redirect checks need to be handled as one recovery process