BLOG · WORDPRESS SECURITY
How malware gets in, where it hides and how to really remove it: files, database, cron jobs, processes and logs.
Sold plugins and breached developer accounts: how an official update delivers a backdoor to your site, and how to spot it with diffs, checksums and logs.
Read the article
Widgets, theme_mods and autoloaded options: how serialized payloads hide in wp_options and how to remove them without breaking value lengths.
Read the article
MySQL triggers, procedures, events, payloads in wp_options and wp_posts, and ghost administrators: how malware lives in the database and how to find it with SQL.
Read the article
A fake kworker at 400% CPU: unmask a cryptominer with /proc and ss, find its persistence, stop it in the right order and work out how it got…
Read the article
Same system user, shared PHP pools, forgotten staging copies: why one infected site contaminates the others on the account, and how to truly isolate them.
Read the article
Clone pages of banks and couriers in hidden folders: how a phishing kit lands on WordPress, how to find it, preserve evidence and request a review.
Read the article
Format, paths, time zones and rotation of Apache, NGINX and LiteSpeed logs, plus grep and awk recipes to trace an infected file back to the attack request.
Read the article
Injected auto_prepend_file, AddHandler and rewrite rules: how .htaccess and .user.ini load backdoors before WordPress, and how to find, verify and remove them.
Read the article
User crontabs, /etc/cron.d and WP-Cron events: where the persistence that reinfects a WordPress site after cleanup hides, and how to inspect it.
Read the article
Every hour counts: the malware keeps hitting visitors and customers, and Google, your host and the blacklists won’t wait. Choose a plan, pay online and share your access: the cleanup starts right away, at a fixed price and with guaranteed times.
Request a cleanupTakes you to the plans: cleanup within 6, 12 or 24 hours of receiving access.
Monday – Friday · 9:30am – 7:30pm Italian time (CET)