A client came to us after their site started redirecting some visitors to unrelated pharmaceutical ads and their hosting provider flagged the account for suspicious activity. This is a walk-through of what we found and how we recovered it, without naming the client.
The starting point
The site had been built two years earlier and left largely untouched since. No maintenance plan was in place, and the WordPress admin login used a simple, guessable password that had not been changed since launch.
What we found
Outdated plugins with known vulnerabilities.
Several installed plugins had not been updated in over a year, including one with a publicly documented vulnerability that had been exploited to gain access.
Hidden malicious files.
Malware had been quietly injected into the theme files, generating spam pages that were not visible through the normal site navigation but were indexed by search engines.
A backdoor script.
A hidden file allowed the attacker to regain access even after a password change, which is a common technique that makes simple fixes ineffective.
How we cleaned it up
We took the site offline temporarily to stop further damage, then scanned every file against a clean copy of the theme and plugins to identify what had been altered or added. All compromised files were removed and replaced with clean versions. Every password and access key was reset. We patched the vulnerable plugin and removed two others that were no longer needed and had not been updated in years.
What we put in place afterward
A proper maintenance plan with monthly updates and monitoring, off-site automated backups, a security firewall to block common attack patterns, and two-factor authentication on all admin accounts.
The real lesson
Every issue we found had a preventable cause, and none of it happened overnight. It built up gradually over two years of no attention. Recovery cost significantly more than a year of proper maintenance would have. This is the pattern behind almost every hacked site we clean up, and it is exactly why maintenance is not a cost to avoid, it is what avoids a much larger one.