Security Audit & Malware Removal

A hacked website rarely announces itself in plain language. A client emails to say your homepage now redirects to a pharmacy site in another language. Search Console sends a Safe Browsing notice and paid traffic stops overnight. Your host suspends outgoing email because the domain started sending spam, and customers never received the invoices you thought you sent on Tuesday.

Behind those symptoms sits an entry point: a plugin with a published vulnerability nobody updated, an admin password reused from a service breached elsewhere, a stolen file transfer credential, a configuration file readable at a guessable URL, or a theme downloaded with a backdoor already inside it. Our work is to remove the malicious code and close the entry point it came through.

Cleaning malware and closing the hole are two different jobs

Removing malware is the visible half. A scanner matches known signatures, someone deletes the flagged files, the warning banner disappears, and the invoice goes out again. Six weeks later the same redirect returns, because the administrator account the attacker created is still active and the vulnerable plugin still sits there at the same version.

Closing the hole is what keeps the site clean. That means reading access logs and file timestamps, tracing which request delivered the code and which account let it in, patching the weakness that was used, replacing every credential the attacker could have observed, and watching the site long enough to be reasonably sure a second attempt fails. Cleanup work that stops after deleting files tends to bill you twice for one incident.

What we audit and clean

An audit of a live compromise starts with evidence. We read web server access logs, PHP or application error logs, file modification times, scheduled tasks, and the list of administrator accounts, then work backwards to the first malicious write.

The entry point is usually one of a short list:

• A plugin or theme with a known vulnerability that was never updated
• A nulled or bundled plugin that shipped with a backdoor from the start
• An administrator password reused from another breached service, or guessed on a login form with no rate limit
• Stolen FTP, SFTP, or hosting panel credentials, sometimes taken from malware on a staff laptop
• A database dump, backup archive, or environment file left reachable at a predictable path
• Custom code that passes user input straight into a query, a template, or a file write

We also map what happened after entry, since that determines the cleanup: hidden files in upload directories, added administrator users, rewritten .htaccess or nginx rules, redirects injected into database options, spam pages built for search traffic, and scheduled jobs that quietly reinstall code after someone deletes it.

Who this is for

This work suits WordPress and WooCommerce owners without a developer on staff, agencies whose client site was compromised and who need the work documented, businesses moving a site off a shared host after a breach, and teams running a custom Node.js or Next.js application where an API key or environment file leaked into a public repository or a client bundle.

When customer records, order data, or payment credentials may have been exposed, we document what the logs prove about access and hand that record to your legal or compliance advisers. We do not give legal advice.

What we deliver

The engagement runs in phases, and each one produces something you can read.

Discovery and containment establish whether the site is actively serving malicious code and whether the host is about to suspend the account.

Entry point analysis is a written account of how the code arrived and which weakness allowed it, with the log evidence behind the conclusion.

Removal clears injected files, backdoors, rogue administrator accounts, malicious scheduled jobs, and modified system files. Infected core files are replaced with clean copies at the same version.

Patching updates the CMS core, plugins, themes, PHP or Node runtime, and application dependencies, and retires whatever has no maintainer left.

Credential rotation covers hosting panel access, SFTP and database users, CMS administrator accounts, API keys, payment gateway keys, SMTP and email accounts, and CDN or firewall logins. Any key readable from the server counts as exposed.

SSL and TLS configuration verifies the certificate chain and renewal, forces HTTPS, sets a current TLS version and cipher set, and enables HSTS.

A web application firewall blocks the known malicious request patterns and rate limits login and XML-RPC endpoints. On WordPress this pairs with file permission review, disabled file editing, and two factor authentication for administrators.

Backups run on a schedule and are stored outside the hosting account, with one restore tested.

Monitoring watches file integrity, administrator account changes, and certificate expiry, and alerts the person who acts on it.

How the engagement runs during an active incident

Taking a shop offline during trading hours usually costs more than the infection, so containment comes first.

Within the first hours we decide whether the site can keep serving traffic. If it can, we block the malicious paths at the firewall or CDN, disable the specific vulnerable component, and leave checkout and the contact form working. If the host has already suspended the account, we publish a holding page on separate hosting with your phone number, email, and a short line explaining that the site is being repaired, so people searching for your business still reach you by phone.

The cleaning happens on a copy rebuilt from a snapshot, with the entry point patched and credentials rotated. Once that copy is verified, we put it live in a quiet window and keep watching the logs for the next few days, which is when a leftover backdoor usually shows itself.

The order of work does not change: snapshot the current state for evidence, contain the spread, patch the weakness, clean the files and database, rotate credentials, verify on a copy, then monitor. Restoring a backup before patching the weakness reinstates the same open door with your content attached.

You get one written update a day with what changed and what needs a decision from you.

What it costs

Security work starts at our flat rate of $39 per hour, and scope is easier to describe in phases. A single WordPress site with redirect malware and one vulnerable plugin is usually a short job measured in hours. Sites reinfected after a cheaper cleanup, stores holding order and customer data, and custom applications with a large codebase take longer, because verification is the slow part. Hardening is a separate phase: firewall rules, TLS work, backup automation, and monitoring setup. Teams with a standing queue of platform and security work can move to a monthly capacity plan from $2,699, and the pricing page explains both models and what each includes.

Proof

design.vasilkoff.com is our own designer portfolio, built on Next.js with no database, no plugin set, and no admin login exposed to the internet. It shows the same principle from the other direction: a site with almost no attack surface has almost nothing to breach, which is the cheapest security decision at the start of a project.

OnlinePay Wallet was a fintech wallet build for iOS and Android, where we handled bank-grade security requirements including biometric login, encrypted local storage, KYC verification, and regulatory audit logging across multiple jurisdictions. It shows we can work to a standard set by regulators and auditors, and that credential handling and access records stay documented under external review.

Related services

• Web development for the front-end and back-end work that surrounds a post-incident rebuild
• WordPress development for the platform where most of these compromises start
• Website maintenance and support for the update, backup, and monitoring routine that prevents the next incident
• Custom plugin and extension development when a plugin has to be replaced, rebuilt, or audited line by line
• Vibe-coded app rescue when AI-generated code carries exposed keys, missing authentication, or unvalidated input

Next step

If your site is redirecting, sending spam, or showing a warning page, send us the domain and the host name. We will tell you what we can see from outside and what the first phase would involve.

Contact us with the domain and a short description of what changed, or run the scope through the Vasilkoff.info estimator for a first estimate before you speak to anyone.