Fake browser updates and fake CAPTCHAs: when your site infects your visitors
Fake browser updates and ClickFix fake CAPTCHAs: how the script that infects visitors works, why you can’t see it, and how to find and remove it.
Read the article
BLOG · WORDPRESS SECURITY
Analysis and deep dives
on WordPress security.
How malware gets in, where it hides and how to really remove it: files, database, cron jobs, processes and logs.
-
-
Restoring a backup is not enough: why malware survives a restore
Backups with dormant backdoors, persistence outside the site, and the same hole still open: why a restore is not enough and how to use backups for analysis.
Read the article
-
Infected WordPress Multisite: Cleaning a Network of Sites Without Taking It Down
Per-site tables, super admins and network plugins: how to inventory, contain and clean an infected WordPress Multisite network without shutting down the other sites.
Read the article
-
Hacked Site and GDPR: When a Data Breach Must Be Notified to the Garante
When a compromised WordPress site becomes a data breach, who must notify the Italian Data Protection Authority within 72 hours, and how forensic evidence guides the assessment.
Read the article
-
0-day vulnerabilities in WordPress plugins: what to do before a patch exists
A vulnerable plugin and no patch: how to tell whether you are exposed, block the endpoint with a WAF, NGINX, or Apache, and look in the logs for…
Read the article
-
Obfuscated PHP Files: Malware or a Plugin Encrypted with ionCube or SourceGuardian?
Base64, gzinflate and eval chains, and files encrypted with ionCube, SourceGuardian or Zend Guard: how to tell a licensed plugin from obfuscated malware.
Read the article
-
Monitoring WordPress File Integrity: Checksums, inotify and AIDE
WP-CLI checksums, sha256 manifests, inotify and AIDE: how to spot a modified or newly appeared file on your site right away, without drowning in false alarms.
Read the article
-
The Server That Sends Spam: PHP Mailing Scripts, Mail Queues and Domain Reputation
How to recognize a server that is sending spam, find the PHP script responsible, flush Postfix and Exim queues, and recover your domain’s reputation.
Read the article
-
Fake orders and carding on WooCommerce: checkout and REST API abuse
Hundreds of failed orders overnight: how to recognize card testing on WooCommerce and stop it across checkout, Store API, web server and payment gateway.
Read the article
THE NEXT STEP
Is your site
infected?
Every hour counts: the malware keeps hitting visitors and customers, and Google, your host and the blacklists won’t wait. Choose a plan, pay online and share your access: the cleanup starts right away, at a fixed price and with guaranteed times.
Request a cleanupTakes you to the plans: cleanup within 6, 12 or 24 hours of receiving access.
MANAGED SERVER S.R.L.info@malwarecleanup.com +39 02 5656 9681
Monday – Friday · 9:30am – 7:30pm Italian time (CET)
Prefer an online form?
Contact us at managedserver.it ↗
Contact us at managedserver.it ↗