Blog · Field-tested knowledge
Field-informed articles about malware behavior, hacked-site recovery, WordPress errors, maintenance, development, and safer website ownership.
Spam on WordPress does not always look the same. One website may receive hundreds of promotional comments. Another may get nonsense messages through its contact form. An online store may suddenly receive fake WooCommerce orders, while a membership site may fill up with bot-generated user accounts. The mistake I often see is treating every type […]
Read blog
During a recent WordPress malware investigation, I found this code at the beginning of a plugin file: <?php if (file_exists(dirname(__FILE__) . ‘/class.plugin-modules.php’)) { include_once(dirname(__FILE__) . ‘/class.plugin-modules.php’); } ?> It is only one short line, and the rest of the file looked like normal plugin code. But the referenced file name immediately stood out: class.plugin-modules.php This […]
Read blog
Quick answer: Yes, you can secure WordPress without any security plugins. Most real protection comes from two layers you control directly: application hardening (wp-config.php rules, correct file permissions, disabled file editing) and server-level controls (a web-server firewall, blocked PHP execution, least-privilege database access). Plugins add convenience and monitoring, not the foundation. After manually cleaning more […]
Read blog
Quick Answer: Can a file that looks like an image, PDF, or CSS contain malware on a WordPress site? Yes. On a hacked WordPress site, attackers routinely hide PHP backdoors, JavaScript redirects, and webshells inside files that look harmless — .jpg, .png, .gif, .ico, .svg, .pdf, .css, and even .txt or .log. The file extension […]
Read blog
You opened your laptop, typed your domain, and instead of your site you got a page screaming “This Account Has Been Suspended” — or “This site is currently unavailable” on SiteGround, or “Hosting plan is suspended” on Hostinger. Your host pulled the plug. And in most of these cases, the trigger isn’t a missed invoice. […]
Read blog
If your WordPress site is loading scripts from domains you’ve never heard of, if Google Search Console suddenly shows queries about slot gacor or zeus379, or if your security plugin keeps saying “site is clean” while your traffic quietly tanks — you are almost certainly dealing with a database-level spam backlink injection. This isn’t a […]
Read blog
Quick answer A WordPress supply chain attack is when malicious code ships through the official update channel of a plugin you already trust — because the plugin was bought by a bad actor, the vendor’s update server was hijacked, or a maintainer’s account was compromised. The April 2026 Essential Plugin incident (31 plugins, ~400,000 sites) […]
Read blog
Quick answer: htaccess.spam-seo.redirect.006 is a Sucuri SiteCheck signature — not a virus name. It means Sucuri’s scanner found malicious RewriteRule or RewriteCond directives inside your WordPress .htaccess file that redirect visitors (or only Google’s crawler, or only mobile users) to spam, gambling, or pharmacy domains. The fix is to restore the default WordPress .htaccess, then […]
Read blog
⚡ Quick Answer simplecopseholding.com is a malicious domain used by the SocGholish (TA569) malware family — the same threat actor linked to LockBit, Evil Corp, and even Russia’s GRU Unit 29155. If your WordPress site redirects visitors to simplecopseholding.com, exovandria.shop, secretplans.discoveryment.my.id, a fake “Play and Learn” subscription page, or a “Click Allow to Verify You […]
Read blog
Your scanner says clean. The files look fine. But Google still flags the site, mobile users still get redirected, or your sitemap is suddenly full of pharma URLs you never wrote. If that’s where you are right now, the malware almost certainly isn’t in the files anymore. It’s in the database. I’ve cleaned 4,500+ hacked […]
Read blog