01

What I build

  • Incident response

    Containment first, then a clear separation of what was compromised: the site, the hosting account, or the server.

  • Persistence hunting

    Malicious cron jobs, WordPress cron hooks, drop-in files and rogue users, the things that bring malware back after a cleanup.

  • Server-level checks

    Indicator-of-compromise scans, processes, scheduled tasks and logs, not only a plugin scan.

  • Hardening

    Updates, permissions, credentials, backups and the server settings that close the way back in.

  • Read-only code scanning

    My own File Scan Code Search plugin searches a site's code for patterns without changing anything.

02

How I work

  1. Step 1
    Contain

    Stop the active damage and keep the evidence needed to understand it.

  2. Step 2
    Scope it

    Account-level or root-level compromise? The answer decides how deep the cleanup must go.

  3. Step 3
    Remove persistence

    Find and remove every mechanism that would reinfect the site: cron, drop-ins, hooks, users.

  4. Step 4
    Verify

    Scan again, check processes and scheduled tasks, and confirm the indicators are gone.

  5. Step 5
    Harden and report

    Close the entry point, list what remains to watch, and explain it in plain words.

03

Selected work

Client names are redacted to protect their systems. The work and the numbers are real.

  • Delivered · Incident response

    Compromised hosting account

    A hosting account was running Base64-encoded shell commands from an hourly cron job. The investigation separated account-level from root-level compromise, then removed the persistence: a malicious object-cache.php drop-in in wp-content and two malicious WordPress cron hooks.

    An indicator-of-compromise scan came back clean, the server was rebooted and its kernel recovered, and the remaining follow-up items were documented.

    • Cron
    • WordPress drop-ins
    • IOC scan
    • Linux server

    Read the case study →

  • Free tool

    File Scan Code Search

    A read-only WordPress plugin that searches a site's code for text and patterns without changing a file. Scanning outside WordPress is opt-in through wp-config, so it never reaches further than you allow.

    • WordPress plugin
    • Read-only
04

Quick answers

My site was cleaned but got hacked again. Why?

Usually because the persistence was missed: a cron job, a drop-in file, a hidden user or a WordPress cron hook that reinstalls the malware. Finding those is the core of the job.

Is a security plugin enough?

It helps, but plugins only see WordPress. Some infections live in the hosting account or server, which needs a server-level check.

Do you also secure the server?

Yes. I manage VPS and Plesk hosting in-house, including updates, permissions, SSL and backups.

05

Related