I got an emergency call a few weeks back. A new client’s site was redirecting to some shady online pharma store. They had been fighting it for days. They had run the usual malware scans, deleted suspicious files, even restored a backup. But two hours later the hack was always back. A total nightmare. They were convinced it was a sophisticated server-level attack. It rarely is.
This kind of thing is where WordPress security stops being theoretical. My first sweep found the obvious stuff: some nasty base64 encoded junk in wp-content. I cleaned it out, the site came back, and I told the client to keep an eye on it. An hour later my phone rings. It is back. The malware was only the symptom. The actual problem was an open backdoor the attacker kept using to get back in, and my first cleanup had not closed it.
WordPress security is about closing doors
Everyone focuses on scanning and cleaning, but that is like mopping the floor while a pipe is still leaking. What matters is finding the entry point, the attack vector. In this client’s case it was a PDF generation plugin that had not been updated since 2018. It had a known vulnerability that let anyone upload files, and the attacker used it to install a tiny script that gave them permanent access. While I was digging through the logs, I was reminded of an overview on this I read a while back over at carlalexander.ca.
You have to work methodically. Do not just delete the infected files; figure out how they got there. Check your file modification dates and look at the server logs. More often than not it is an outdated plugin or theme, or worse, a “nulled” premium theme someone downloaded for free. Free rarely stays free.
One of the first things I do on any site I manage is lock down the most common vectors. The built-in theme and plugin editor, for instance, is a real risk. If an attacker gets an admin password, that editor hands them a direct way to run any code they want. You should not be editing files on a live site anyway. Disabling it for good is a one-liner in your wp-config.php file.
// Disallow file edits from the WordPress dashboard
define( 'DISALLOW_FILE_EDIT', true );So what’s the takeaway?
Security is not a plugin you install and forget. It is a process of adding layers and reducing your attack surface.
- Do not use defaults. If your username is “admin,” you are making an attacker’s job much easier. The same goes for the default “wp_” database prefix on a new install.
- Delete what you do not use. Every inactive plugin and theme is an unmonitored security hole. Get rid of them.
- Use strong, unique passwords. For everything: WordPress admin, FTP, hosting control panel. Use a password manager.
This stuff gets complicated fast. If you are tired of debugging someone else’s mess and just want your site to work, drop my team a line. We have probably seen it before.
