Find it before you remove it
A clean-up starts with working out what got in and how, not with deleting files. Until you know the entry point, removing the payload only buys time until the same door is used again.
News publisher · Ghana
A Ghanaian publisher
A Ghanaian publisher came to us after a compromise. We removed the malware, cleaned up what it left behind and hardened the site against a repeat. They have not agreed to be named, so nothing here identifies them.
Malware clean-upHardening
How it's built
Clean, then close the door
Once the site was clean we changed every credential, removed the abandoned plugins and themes that gave the attacker somewhere to hide, and locked down the file permissions and the admin surface.
Make a repeat visible
File-integrity monitoring and scanning went on afterwards, so a change nobody authorised is noticed rather than discovered months later by a search engine.
What it does
Entry point traced
The compromise was tracked to its source before anything was deleted.
Malware removed
Injected code, backdoors and unauthorised admin accounts cleared out.
Hardened afterwards
Credentials rotated, unused plugins and themes removed, permissions and the admin surface locked down.
Monitoring in place
File-integrity monitoring and scanning so a repeat shows up immediately.
Under the hood
- Platform
- WordPress
- Work
- Malware removal, clean-up and hardening
- Client
- Not named at their request
How we look after it
- Malware scanning and file-integrity monitoring
- WordPress core, theme and plugin updates
- Off-site backups with restores on request
- Hardening reviewed as the site changes
Sites that arrived broken or compromised, fixed and then kept healthy.
Want this for your site?
Tell us what you have and what it needs. We'll be straight about whether we're the right fit.