Blog · Field-tested knowledge
Field-informed articles about malware behavior, hacked-site recovery, WordPress errors, maintenance, development, and safer website ownership.
The Symptoms: Thousands of blank admin users in the dashboard, and a “critical error” that crashes the Posts page. The Cause: Advanced database malware stripping primary key constraints to inject spam and rogue accounts using an ID of 0. The Fix: Executing targeted SQL queries via phpMyAdmin to purge the zero-ID records and repair the […]
Read blog
A WordPress malware scanner reports that everything is clean. However, visitors are still being redirected, unfamiliar scripts continue loading, or the infection returns shortly after suspicious files are removed. This does not necessarily mean that the scanner is broken. It usually means that the investigation has been limited to only one part of the website. […]
Read blog
Spam on WordPress does not always look the same. One website may receive hundreds of promotional comments. Another may get nonsense messages through its contact form. An online store may suddenly receive fake WooCommerce orders, while a membership site may fill up with bot-generated user accounts. The mistake I often see is treating every type […]
Read blog
During a recent WordPress malware investigation, I found this code at the beginning of a plugin file: <?php if (file_exists(dirname(__FILE__) . ‘/class.plugin-modules.php’)) { include_once(dirname(__FILE__) . ‘/class.plugin-modules.php’); } ?> It is only one short line, and the rest of the file looked like normal plugin code. But the referenced file name immediately stood out: class.plugin-modules.php This […]
Read blog
Quick answer: Yes, you can secure WordPress without any security plugins. Most real protection comes from two layers you control directly: application hardening (wp-config.php rules, correct file permissions, disabled file editing) and server-level controls (a web-server firewall, blocked PHP execution, least-privilege database access). Plugins add convenience and monitoring, not the foundation. After manually cleaning more […]
Read blog
Quick Answer: Can a file that looks like an image, PDF, or CSS contain malware on a WordPress site? Yes. On a hacked WordPress site, attackers routinely hide PHP backdoors, JavaScript redirects, and webshells inside files that look harmless — .jpg, .png, .gif, .ico, .svg, .pdf, .css, and even .txt or .log. The file extension […]
Read blog
You opened your laptop, typed your domain, and instead of your site you got a page screaming “This Account Has Been Suspended” — or “This site is currently unavailable” on SiteGround, or “Hosting plan is suspended” on Hostinger. Your host pulled the plug. And in most of these cases, the trigger isn’t a missed invoice. […]
Read blog
If your WordPress site is loading scripts from domains you’ve never heard of, if Google Search Console suddenly shows queries about slot gacor or zeus379, or if your security plugin keeps saying “site is clean” while your traffic quietly tanks — you are almost certainly dealing with a database-level spam backlink injection. This isn’t a […]
Read blog
Quick answer A WordPress supply chain attack is when malicious code ships through the official update channel of a plugin you already trust — because the plugin was bought by a bad actor, the vendor’s update server was hijacked, or a maintainer’s account was compromised. The April 2026 Essential Plugin incident (31 plugins, ~400,000 sites) […]
Read blog
Quick answer: htaccess.spam-seo.redirect.006 is a Sucuri SiteCheck signature — not a virus name. It means Sucuri’s scanner found malicious RewriteRule or RewriteCond directives inside your WordPress .htaccess file that redirect visitors (or only Google’s crawler, or only mobile users) to spam, gambling, or pharmacy domains. The fix is to restore the default WordPress .htaccess, then […]
Read blog