01
Incident investigation
The filesystem, WordPress installation and suspicious files were reviewed to understand the extent of the incident.
← Selected work
Arts and publishing
Recovering a complex WordPress platform
Securing, stabilising and maintaining a content-heavy WordPress platform with ecommerce, subscriptions and a large digital archive.
- Industry
- Arts and publishing
- Role
- Web developer and technical partner
- Scope
- Recovery, security, maintenance and web development
- Status
- Ongoing technical support
- Client
- Confidential
01 / Context & challenge
Understanding the operational problem
The platform combines editorial content, ecommerce and a large media archive. That makes recovery and maintenance more complex than replacing a small marketing website.
After a security incident, the immediate need was to identify malicious files and restore confidence in the installation. The longer-term challenge was to preserve publishing and commercial functionality while reducing the risk of the same situation returning.
02 / My role
Where I was responsible
- Investigation and removal of malicious or unexpected files.
- Verification of WordPress core and review of the application structure.
- Coordination with hosting and security providers.
- Performance, caching and operational troubleshooting.
- Ongoing development and maintenance of the publishing platform.
03 / Solution
Building a maintainable system
02
Controlled recovery
Malicious components were removed while preserving legitimate editorial content, media and ecommerce operations.
03
Security layers
Core verification, access review, hosting controls and Cloudflare protections were combined instead of relying on a single plugin.
04
Ongoing ownership
Maintenance continues after recovery so that new problems can be investigated in the context of the wider platform.
04 / System view
How the main parts connect
Simplified to protect confidential technical and commercial information.
Visitors & editors
WordPress platform
Commerce & archive
05 / Outcome
What changed
- The legitimate publishing platform was preserved during recovery.
- Malicious and unexpected files were isolated and removed.
- Core files and application behaviour were reviewed systematically.
- Security responsibilities across WordPress, hosting and Cloudflare became clearer.
- The platform returned to an ongoing maintenance workflow.
Technology
- WordPress
- WooCommerce
- PHP
- Cloudflare
- Hosting security
The client has been anonymised, and selected implementation details have been omitted for confidentiality.
Facing a similar challenge?