The situation
A recurring pattern of infections across healthcare, dental, veterinary, and med-spa sites, from a suspected hack (an odd graphic on a homepage) to full compromise. For each site the questions were the same: is it infected, what exactly is the malware, and how do we clean it without breaking a live client site? Analysis showed one actor and the same malware families across the portfolio, which pointed to a shared entry point rather than seven unrelated breaches.
The method
Intake from a full archive plus a database export, so both the injector and its persistence are visible. Verify WordPress core and every plugin against official published checksums, which localizes tampering with zero false positives on known code. Sweep all PHP for webshells, obfuscated loaders, and self-hiding plugins, and hunt for doorway pages and PHP hidden in uploads. Analyze the database for injected script domains, rogue administrators, code-snippet tables, and scheduled tasks. Triage every finding against a catalogue of benign lookalikes. Remediate over SFTP with backups retained and a surgical, transaction-wrapped SQL cleanup per site.
What it found
Malware that evades file-only scanning: plugins that removed themselves from the admin list, and one infection that lived entirely in a database table with no malicious file at all. Fake plugins posing as core or security components, folders named with random timestamps, and backdoors with homoglyph filenames like functlons.php. Live credential-phishing overlays, command-execution webshells, and darknet marketplace doorway pages served to visitors. The worst site carried 21 rogue plugin folders, a rogue theme, a webshell, an attacker-created administrator, and injected SEO spam; 995 file operations removed all of it live with zero errors and no legitimate files touched. And one "hack" that was a stale cookie-banner cache.
The deliverable
Four compromised sites returned to a verified clean state, three verified clean with root causes explained, and portfolio-level guidance to close the shared entry point. The whole method became a self-contained toolkit: filesystem and database scanners, SFTP automation with safe recursive removal, generators that produce an exact removal plan and a tailored cleanup script, and reference libraries for signatures, the actor's indicators, and the false-positive catalogue. Validated against a live infected site, it reproduced the manual cleanup exactly and surfaced injected content the manual pass had missed.
In brief
- What is WordPress Incident Response?
- Malware assessment and remediation across a managed portfolio of healthcare WordPress sites, run evidence-first so nothing legitimate was ever deleted, then turned into a toolkit that makes the next incident a guided procedure.
- What did Brian Powell build for WordPress Incident Response?
- Intake from a full archive plus a database export, so both the injector and its persistence are visible. Verify WordPress core and every plugin against official published checksums, which localizes tampering with zero false positives on known code. Sweep all PHP for webshells, obfuscated loaders, and self-hiding plugins, and hunt for doorway pages and PHP hidden in uploads. Analyze the database for injected script domains, rogue administrators, code-snippet tables, and scheduled tasks. Triage every finding against a catalogue of benign lookalikes. Remediate over SFTP with backups retained and a surgical, transaction-wrapped SQL cleanup per site.
- What was the result of WordPress Incident Response?
- Four compromised sites returned to a verified clean state, three verified clean with root causes explained, and portfolio-level guidance to close the shared entry point. The whole method became a self-contained toolkit: filesystem and database scanners, SFTP automation with safe recursive removal, generators that produce an exact removal plan and a tailored cleanup script, and reference libraries for signatures, the actor's indicators, and the false-positive catalogue. Validated against a live infected site, it reproduced the manual cleanup exactly and surfaced injected content the manual pass had missed.