WordPress Incident Response
Malware assessment and remediation across a portfolio of seven client WordPress sites: four active compromises confirmed and cleaned with zero data loss, a coordinated threat campaign identified, and the whole methodology packaged into a reusable detection-and-remediation toolkit.
The situation
A recurring pattern of infections was appearing across a managed portfolio of healthcare, dental, veterinary, and med-spa WordPress sites. Symptoms ranged from a suspected hack (an odd graphic on a homepage) to full compromise. The core question for each site: is it infected, what exactly is the malware, and how do we clean it without breaking a live client site?
Analysis established the infections were not isolated. The same actor reappeared across multiple sites using the same malware families, pointing to a shared entry point, reused administrator credentials or a single compromised hosting account, rather than seven unrelated breaches.
The methodology
A consistent, evidence-first process was applied to every site and later codified into tooling.
- Intake from a full site archive plus a database export, so both the injector code and its persistence are visible, with SFTP for live fixes.
- File integrity verification of WordPress core and every plugin against official published checksums, which localizes tampering with zero false positives on known code.
- Signature sweeps across all PHP for webshells, obfuscated loaders, and self-hiding plugins, plus hunts for doorway pages and PHP hidden in uploads.
- Database analysis of active plugins, code-snippet tables, injected script domains, administrator accounts, and scheduled tasks.
- Triage against false positives, separating genuine malware from benign lookalikes so nothing legitimate is ever deleted.
- Remediation over SFTP with backups retained, plus a surgical, transaction-wrapped database cleanup script per site.
- Reporting and hardening: a clear verdict, the exact actions taken, and standing guidance to close the shared entry point.
What was found
- A coordinated multi-site campaign. One actor, consistent malware families, across an entire managed portfolio. Recognizing the pattern turned later cleanups from open-ended investigations into fast, confident operations.
- Malware that evades file-only scanning. Self-hiding plugins removed themselves from the admin plugin list, and one infection lived entirely in a database table with no malicious plugin file at all.
- Deception techniques. Fake plugins posing as core or security components, folders named with random timestamps, and backdoors disguised with typo and homoglyph filenames, like “functlons.php” standing in for “functions.php”.
- Live threats actively served to visitors. Credential-phishing overlays, command-execution webshells, and darknet marketplace doorway pages, all removed.
- The worst case: one site carried 21 rogue plugin folders, a rogue theme, a command-execution webshell, an attacker-created administrator, and injected SEO spam. 995 file operations removed all of it live, with zero errors and no legitimate files touched.
- Not everything is a hack. One “compromised” homepage traced to a stale cookie-banner cache, and a multi-hundred-megabyte database import that kept failing on gateway timeouts was recovered with compression, transient-table trimming, and chunked imports.
The deliverable: a reusable toolkit
The methodology was packaged into a self-contained toolkit so the entire workflow is repeatable and institutional knowledge outlives the incident: automated filesystem and database scanners, SFTP automation with safe recursive removal, generators that produce an exact file-removal plan and a tailored database cleanup script, and reference libraries covering detection signatures, the actor’s known indicators, and the false-positive catalogue.
Validated against a live infected site, the toolkit reproduced the manual cleanup exactly and additionally surfaced injected content the initial manual pass had missed.
Outcomes
- Four compromised sites returned to a clean, verified state; three sites verified clean, with root causes explained for the non-hacks.
- Active phishing and darknet content removed from public-facing client sites.
- Zero legitimate files or data lost during remediation, across every site.
- Future incident response reduced from hours of manual investigation to a guided, script-assisted process.
- Root cause identified at the portfolio level, with clear guidance to close the shared entry point and prevent recurrence.
Questions
FAQ
What was the WordPress incident response engagement?
Brian Powell assessed seven client WordPress sites on managed hosting for malware, confirmed and remediated four active compromises, verified three sites clean, and built a reusable detection-and-remediation toolkit that turns a multi-hour manual investigation into a repeatable, script-assisted workflow.
How were infections found without false positives?
An evidence-first process verifies WordPress core and every plugin against official published checksums, sweeps all PHP for webshells and obfuscated loaders, and analyzes the database for injected scripts, rogue administrators, and malicious code snippets. Roughly fifteen categories of benign lookalikes were catalogued so nothing legitimate is ever deleted from a production site.
Can malware hide from a normal file scan?
Yes, and this engagement found it. Self-hiding plugins removed themselves from the admin plugin list, and one infection lived entirely in a database table with no malicious plugin file at all. Scanning both the filesystem and the database was essential to catching everything.
What made the cleanups safe on live sites?
Malicious files were removed over SFTP with backups retained, database fixes shipped as surgical transaction-wrapped SQL, and every action was triaged against a catalogue of false positives first. Even the worst site, with 21 rogue plugin folders, was cleaned in 995 file operations with zero errors and no legitimate files touched.