PROJECT
Ahaaha Consultants — WordPress Malware Recovery
Recovery and security cleanup of a compromised legacy WordPress website affected by malicious redirects and frontend availability issues.
OVERVIEW
The project.
THE CHALLENGE
What needed to change.
The client's existing WordPress website had become unreliable: the homepage was no longer displaying correctly, while visitors arriving through Google could be redirected to unrelated spam pages.
The website was built on an older WordPress installation with an established theme and plugin stack, so the priority was not to rebuild the site. The immediate requirement was to investigate the existing environment, identify suspicious changes and restore the public website while minimising disruption to the original site.
THE APPROACH
How I approached it.
I approached the incident as a recovery task rather than immediately replacing the existing website.
The investigation included reviewing the WordPress installation, checking core files, inspecting plugins and themes, examining unexpected WordPress components and reviewing administrator accounts for suspicious changes.
WordPress core integrity checks did not indicate modified core files, which helped narrow the investigation toward other parts of the installation. A suspicious MU-plugin was identified and removed, and unnecessary administrator accounts were cleaned up.
Once the immediate issues were addressed, the public-facing website was restored and checked to confirm that the original site could continue operating.
I also reviewed the wider installation to identify maintenance concerns, including the legacy WordPress environment and unusually large backup/storage usage, providing a clearer basis for future maintenance and improvement work.
SELECTED SCREENS
Across desktop and mobile.
SERVICES
WordPress Recovery
Malware Investigation & Cleanup
Website Troubleshooting
Security Review
Website Health Check
TECHNOLOGIES
WordPress
PHP
AWS Lightsail
Bitnami
Apache
SSH / Linux
OUTCOME
The result.
The public website was recovered without requiring an immediate rebuild, allowing the client to continue using their existing site.
The malicious behaviour and suspicious components identified during the investigation were addressed, unnecessary administrator accounts were removed, and the client received a clearer picture of the site’s technical condition and areas requiring future maintenance.
The recovery also separated the urgent restoration work from longer-term improvement opportunities, allowing those decisions to be considered independently rather than expanding the incident response into an unnecessary rebuild.
WORDPRESS TROUBLESHOOTING
Facing a similar WordPress problem?
A compromised website doesn't always need a complete rebuild. I can help investigate the issue, identify the cause and explore a practical recovery approach.
Discuss your website problem →