WordPress hacked?Close the way in.
Malware, redirects or a red Google warning? We find the entry point, remove the malware and patch the hole it came through.
- NDA before access. Full backup before cleanup.
- Root cause, not just file deletion
$ grep -E "fb_upload|/uploads/.+\.php" access.log. 03:11:52 POST /wp-admin/admin-ajax.php?action=fb_upload 200. 03:11:54 GET /wp-content/uploads/2026/10/cache.php?c=id 200. entry point: form-builder 2.1 · unauthenticated upload. $ wp user list --role=administrator. wp_sys registered 2026-10-27 03:12 (not the owner). $ wp user delete wp_sys --reassign=1 && rm uploads/2026/10/cache.php. hidden admin + webshell removed. $ wp plugin update form-builder. form-builder 2.1 → 2.2 (patched). way in closed · backup verified · report ready
Three ways we secure WordPress.
Incident response & malware removal
Contain the attack, find the entry point, clean code and database, and request a Google review once the site is clean.
Report an incidententry pointform-builder 2.1 uploadremoved1 webshell · 1 hidden adminpatchedform-builder 2.2
WordPress penetration testing
Test custom plugins, themes, access controls and attack chains the way a real adversary would — within an agreed scope.
Request a pentestGET /wp-json/shop/v1/orders/:idas a subscriberobservedother customers' ordersfixcapability check
Hardening & monitoring
Lock down server and WordPress configuration, enforce 2FA, and watch for file changes.
Ask about hardening2FA for administratorsonXML-RPCoffDISALLOW_FILE_EDITtruebackup restore testpassed
How they got in.
One example of a WordPress compromise, step by step. Every incident we handle is investigated from its own evidence.
- 01Entry point
T1190Bots find an outdated plugin and use it to upload a file.POST /wp-admin/admin-ajax.php?action=fb_upload 200 - 02Persistence
T1505.003 · T1136A webshell and a hidden administrator keep them in after a quick cleanup.uploads/2026/10/cache.php eval(base64_decode(…)) · wp_sys role=administrator - 03Impact
T1565.001Visitors are redirected to spam and Google flags the site..htaccess RewriteRule ^(.*)$ https://spam.example/ [R=302]
POST /wp-admin/admin-ajax.php?action=fb_upload 200uploads/2026/10/cache.php eval(base64_decode(…)) · wp_sys role=administrator.htaccess RewriteRule ^(.*)$ https://spam.example/ [R=302]
We watch what attackers use.
Our engine syncs NVD, CISA KEV and WordPress advisories around the clock, so every fix starts from what attackers use now.
A few questions.
Will malware removal delete my data?
We back up the full codebase and database first. Cleanup removes or repairs only compromised files and records, and we tell you before touching anything that holds content, orders or members.
Can the site get reinfected?
Reinfection is possible. We close the original entry point, remove backdoors, rotate credentials and harden the site to reduce the risk.
Do you need my admin password?
For incident response we need hosting or SFTP access; for a black-box pentest we don't. All access is covered by an NDA, and credentials should be rotated afterwards.
How is a pentest different from a plugin scan?
Plugins match known signatures. A pentest is a specialist actively attacking within an agreed scope — access control, REST API, uploads, custom code and chained flaws.
Tell us what you need.
We review your request and reply with a plan — for incidents, how severe it looks; for pentests, a proposed scope.
Or email [email protected]