WordPress malware

Hundreds of failed orders overnight: how to recognize card testing on WooCommerce and stop it across checkout, Store API, web server and payment gateway.

Sold plugins and breached developer accounts: how an official update delivers a backdoor to your site, and how to spot it with diffs, checksums and logs.

Widgets, theme_mods and autoloaded options: how serialized payloads hide in wp_options and how to remove them without breaking value lengths.

MySQL triggers, procedures, events, payloads in wp_options and wp_posts, and ghost administrators: how malware lives in the database and how to find it with SQL.

Clone pages of banks and couriers in hidden folders: how a phishing kit lands on WordPress, how to find it, preserve evidence and request a review.

How nulled plugins and pirated themes hide backdoors, which signs to look for in the code, and how to verify them with WP-CLI and a comparison against the…

Signatures, heuristics and blind spots: why a scanner running inside WordPress cannot see obfuscated malware, SQL triggers, cron jobs and processes, and how to use it well.

Infostealers, FileZilla, and saved passwords: how FTP logs reveal a stolen login and in what order to rotate credentials before cleaning the site.

Hacked WordPress site? What to do right away: a forensic copy of files, database, and logs, maintenance mode, credentials to change in the right order, mistakes to avoid.