Loading
Loading page contentLoading
Loading page contentAn industrial construction contractor moved their site to us from a previous vendor. The site was already compromised when it arrived, and the host had taken it offline. The cleanup had to happen at the source, before the cutover, or the new home would have inherited the same backdoor.
01 · Situation
The client is unnamed here and so is the previous vendor. The engagement is real; a public account of a security incident on someone else's site needs their written sign-off, and the outgoing vendor is not on trial.
A contractor in environmental, civil and mechanical construction was moving their WordPress site away from the agency that had built it. The hosting plan it sat on had no downloadable backup and no staging environment, which is a poor place to be during a migration and a worse one during an incident. Partway through the move, the host’s own scanner flagged malicious code. The grace period to clean it expired, and the host suspended the website.
The site was offline for roughly two days before we could get it released, after verifying ownership directly with the host.
| Platform | WordPress, page-builder theme, roughly twenty active plugins |
|---|---|
| Hosting | A shared plan with no backup download and no staging |
| State | Compromised, and suspended by the host |
| Vendor | Outgoing, and not responding |
02 · Discovery
The detail worth carrying away is not the backdoor. It is the second administrator.
The host’s scanner listed twenty-one malicious files. Among them was a plugin dressed up as a beta build of a well-known caching plugin, which is a plausible enough name to survive a scroll through the plugin list. There were also staging folders seeded with search spam.
And there were two administrator accounts that did not belong to anyone. One of them used an email address one character away from the site owner’s own, with a single leading letter removed.
03 · Response
Sequence, not speed. Moving first would have carried every one of those files to the new host along with the content.
A migration is a copy. Whatever is on the origin arrives at the destination, including the parts nobody put there. So the cleanup ran against the compromised source before anything moved: rogue accounts and the backdoor removed, the estate checked for other persistence, credentials rotated, and WordPress core reinstalled from official sources. Only then did the site move to a plan that has both staging and downloadable backups, and only then did DNS change.
The practical lesson is a budgeting one. A security assessment of an inherited site is a first-class task at the start of a takeover, not a surprise discovered halfway through it. We price it that way now.
04 · Ongoing
Silent on healthy days. That is the product, and it is the part that is hardest to sell, because working correctly looks like nothing happening.
| Daily | A three-layer check each morning: external reachability and certificates, authenticated inspection of users, files and scheduled tasks, and an advisory pass. Nothing is sent when everything is fine. |
|---|---|
| Weekly | A read-only crawl diffed against a captured baseline. It changes nothing on the site; it reports what moved. |
| Updates | Security and minor core updates apply automatically. Plugin, theme and custom-code updates never run unattended. Majors are tested on staging, and the page-builder family is treated as one compatibility batch. |
| Changes | Inspect · Classify · Implement locally · Test · Protected staging · Screenshots · Client approval · Exact production promotion · Verify and record |
The first weekly review against the captured baseline came back with no drift and every check green. That is one data point, a week after the baseline, and it is stated as one. There is no uptime percentage on this page and no page-speed figure, because we do not have numbers we would be willing to defend, and a metric you cannot defend is worse than no metric.
05 · Next
The tiers and what each one covers are on the maintenance page. If you are mid-migration, or you have just been handed the keys to something you did not build, the assessment is the part to book first.