security · 2026

WordPress Incident Response

Malware assessment and remediation across a managed portfolio of healthcare WordPress sites, run evidence-first so nothing legitimate was ever deleted, then turned into a toolkit that makes the next incident a guided procedure.

  • 0 lostlegitimate files across 7 sites · 4 compromises cleaned
  • 995file operations on the worst site, zero errors
  • 21rogue plugin folders on that one site
  • ~15categories of benign lookalikes catalogued

The situation

A recurring pattern of infections across healthcare, dental, veterinary, and med-spa sites, from a suspected hack (an odd graphic on a homepage) to full compromise. For each site the questions were the same: is it infected, what exactly is the malware, and how do we clean it without breaking a live client site? Analysis showed one actor and the same malware families across the portfolio, which pointed to a shared entry point rather than seven unrelated breaches.

The method

Intake from a full archive plus a database export, so both the injector and its persistence are visible. Verify WordPress core and every plugin against official published checksums, which localizes tampering with zero false positives on known code. Sweep all PHP for webshells, obfuscated loaders, and self-hiding plugins, and hunt for doorway pages and PHP hidden in uploads. Analyze the database for injected script domains, rogue administrators, code-snippet tables, and scheduled tasks. Triage every finding against a catalogue of benign lookalikes. Remediate over SFTP with backups retained and a surgical, transaction-wrapped SQL cleanup per site.

What it found

Malware that evades file-only scanning: plugins that removed themselves from the admin list, and one infection that lived entirely in a database table with no malicious file at all. Fake plugins posing as core or security components, folders named with random timestamps, and backdoors with homoglyph filenames like functlons.php. Live credential-phishing overlays, command-execution webshells, and darknet marketplace doorway pages served to visitors. The worst site carried 21 rogue plugin folders, a rogue theme, a webshell, an attacker-created administrator, and injected SEO spam; 995 file operations removed all of it live with zero errors and no legitimate files touched. And one "hack" that was a stale cookie-banner cache.

The deliverable

Four compromised sites returned to a verified clean state, three verified clean with root causes explained, and portfolio-level guidance to close the shared entry point. The whole method became a self-contained toolkit: filesystem and database scanners, SFTP automation with safe recursive removal, generators that produce an exact removal plan and a tailored cleanup script, and reference libraries for signatures, the actor's indicators, and the false-positive catalogue. Validated against a live infected site, it reproduced the manual cleanup exactly and surfaced injected content the manual pass had missed.

In brief

What is WordPress Incident Response?
Malware assessment and remediation across a managed portfolio of healthcare WordPress sites, run evidence-first so nothing legitimate was ever deleted, then turned into a toolkit that makes the next incident a guided procedure.
What did Brian Powell build for WordPress Incident Response?
Intake from a full archive plus a database export, so both the injector and its persistence are visible. Verify WordPress core and every plugin against official published checksums, which localizes tampering with zero false positives on known code. Sweep all PHP for webshells, obfuscated loaders, and self-hiding plugins, and hunt for doorway pages and PHP hidden in uploads. Analyze the database for injected script domains, rogue administrators, code-snippet tables, and scheduled tasks. Triage every finding against a catalogue of benign lookalikes. Remediate over SFTP with backups retained and a surgical, transaction-wrapped SQL cleanup per site.
What was the result of WordPress Incident Response?
Four compromised sites returned to a verified clean state, three verified clean with root causes explained, and portfolio-level guidance to close the shared entry point. The whole method became a self-contained toolkit: filesystem and database scanners, SFTP automation with safe recursive removal, generators that produce an exact removal plan and a tailored cleanup script, and reference libraries for signatures, the actor's indicators, and the false-positive catalogue. Validated against a live infected site, it reproduced the manual cleanup exactly and surfaced injected content the manual pass had missed.