Security
WordPress Security Incident Response & Recovery
Investigated and recovered a compromised production WordPress environment across multiple security incidents and recovery sessions.
- Client
- Art Revo
- Timeline
- Feb 2026 – Present
- Context
- Art Revo · production incident response
- Live site
- Not publicly linked
My contribution
- 01
Performed forensic analysis of a 352 MB database dump and investigated multiple forms of obfuscated malicious code and unauthorised modifications.
- 02
Identified and removed malicious .htaccess files, backdoor shells, injected files, unauthorised admin access and compromised WordPress core files.
- 03
Replaced compromised WordPress core directories and performed database and filesystem cleanup.
- 04
Investigated suspicious persistence mechanisms, cron activity, hosting-level access and external indicators of compromise.
- 05
Coordinated with the hosting provider's technicians during server-level malware remediation involving immutable file attributes.
- 06
Produced detailed recovery, forensic analysis, root-cause and incident documentation.