WordPress keeps getting hacked? Find the backdoor
WordPress keeps getting hacked after cleanup? Find the backdoors that survive: auto_prepend_file, mu-plugins, fake plugins, cron, sibling sites, open entry points.
Incident response
Guides on Incident response for WordPress sites in the EU — practical steps, the legal background and checklists.
WordPress redirect hack: find and remove spam redirects
WordPress redirect hack: reproduce conditional redirects with curl and dev tools, find them in .htaccess, PHP, the database or CDN, and stop them returning.
PHP2Shell: what WordPress site owners must do now
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP. Check your PHP version, update, restart and watch for signs.
WordPress web shells in uploads: find and block them
Find WordPress web shells in wp-content/uploads with safe commands, block PHP execution on Apache and nginx, review file permissions and close the entry point.
WordPress SEO spam: find hidden casino and pharma links
WordPress SEO spam explained: find hidden casino and pharma links, see what Googlebot sees, clean the database and files, and request a Google review.
WordPress malware removal: a step-by-step plan
WordPress malware removal in eight steps: contain the site, keep evidence, find the entry point, clean from known-good sources, rotate secrets and harden.
12 signs your WordPress site has been hacked
Twelve signs of a hacked WordPress site, from unknown admin users to cloaked redirects, how to check each one, and what to do in the first hour.
Hacked WordPress site? The GDPR 72-hour breach notification
Hacked WordPress site? When a hack is a GDPR data breach, when the 72-hour notification clock starts, what to report, what to document, and who to inform.