Backdoors Hidden in Cron Jobs: Why Malware Comes Back After Cleanup
User crontabs, /etc/cron.d and WP-Cron events: where the persistence that reinfects a WordPress site after cleanup hides, and how to inspect it.
Read the article
BLOG · WORDPRESS SECURITY
Analysis and deep dives
on WordPress security.
How malware gets in, where it hides and how to really remove it: files, database, cron jobs, processes and logs.
-
-
Nulled Plugins and “Free” Themes: How Malware Really Gets onto WordPress
How nulled plugins and pirated themes hide backdoors, which signs to look for in the code, and how to verify them with WP-CLI and a comparison against the…
Read the article
-
Why Security Plugins Miss Malware: The Limits of Signature-Based Scanners
Signatures, heuristics and blind spots: why a scanner running inside WordPress cannot see obfuscated malware, SQL triggers, cron jobs and processes, and how to use it well.
Read the article
-
Stolen FTP credentials from a developer’s PC: when the infection comes from the client
Infostealers, FileZilla, and saved passwords: how FTP logs reveal a stolen login and in what order to rotate credentials before cleaning the site.
Read the article
-
My WordPress site was hacked: what to do in the first two hours
Hacked WordPress site? What to do right away: a forensic copy of files, database, and logs, maintenance mode, credentials to change in the right order, mistakes to avoid.
Read the article
-
Blacklist removal: the review in Google Search Console
Google Safe Browsing, SmartScreen, antivirus and email blacklists: how to request a review in Search Console, when to do it and what timelines to expect.
Read the article
-
“Deleted” PHP processes: malware that lives only in memory
PHP processes deleted from disk but alive in memory, with fake names like kworker: how to find them in /proc, avoid false positives, and save the evidence.
Read the article
-
Hardening wp-config.php: Salts, Constants, and File Permissions
After a cleanup: check wp-config.php, regenerate keys and salts, use the security constants, and set file permissions and ownership correctly.
Read the article
-
JavaScript skimmer in the WooCommerce checkout
How a JavaScript skimmer steals card data in the WooCommerce checkout, where it hides, how to find it from the browser and with a CSP, and what to…
Read the article
THE NEXT STEP
Is your site
infected?
Every hour counts: the malware keeps hitting visitors and customers, and Google, your host and the blacklists won’t wait. Choose a plan, pay online and share your access: the cleanup starts right away, at a fixed price and with guaranteed times.
Request a cleanupTakes you to the plans: cleanup within 6, 12 or 24 hours of receiving access.
MANAGED SERVER S.R.L.info@malwarecleanup.com +39 02 5656 9681
Monday – Friday · 9:30am – 7:30pm Italian time (CET)
Prefer an online form?
Contact us at managedserver.it ↗
Contact us at managedserver.it ↗