Hacks are rarely sophisticated
In ten years of cleanup work we have seen perhaps a handful of genuinely clever intrusions. The rest were automated scanners finding an outdated plugin, a reused password, or a file permission left wide open by a previous developer. The good news is that ordinary discipline defeats ordinary attacks.
The nine habits
- Update weekly, on staging first. Most exploited vulnerabilities had a patch available for weeks or months before the breach.
- Remove what you do not use. A deactivated plugin still sits on disk and can still be reachable. Delete it.
- Unique credentials everywhere. Separate logins for WordPress, hosting, database and FTP, stored in a password manager, never shared by email.
- Two-factor authentication on every admin. Non-negotiable for anyone with the administrator role.
- Limit login attempts and rename the obvious. Rate limiting stops the overwhelming majority of brute-force traffic before it reaches PHP.
- Least-privilege roles. Your copywriter needs Editor, not Administrator. Most sites have three or four administrators too many.
- Off-site backups you have actually restored. A backup you have never tested is a hypothesis, not a safety net. We restore a client backup to staging every quarter.
- File-integrity monitoring. Alerts when core files change unexpectedly usually catch an infection within hours instead of weeks.
- Keep PHP current. Running an unsupported PHP version means no security patches at the language level, whatever your plugins do.
If you are already infected
Do not simply restore an old backup and hope. That returns the site to the same vulnerable state, and reinfection is usually a matter of days. A proper cleanup removes the malicious code, identifies and patches the entry point, rotates every credential, checks for injected admin users and scheduled tasks, then submits review requests to Google Safe Browsing and Bing Webmaster Tools so warnings and ad disapprovals are lifted.
We handle emergency cleanups as a fixed-fee service, typically within one business day. Call us and we will start with a diagnosis, not a sales pitch.
Reviewed by Jennifer Karen Patterson, founder of WP Clerks, Lexington KY. Published .