The Challenge
For a financial adviser the website is part of the firm's credibility. Clients and regulators both expect it to be right, and a hacked site that quietly serves spam or hands an attacker an admin login is a serious problem even when nobody has noticed yet.
- Nobody knew. The site looked normal. The infection had been there since late July.
- An attacker had a key. In September the malware created an administrator account that did not appear in the normal user list.
- It fought back. A process running in the background rebuilt the malware when pieces of it were deleted, which is why a simple cleanup would not have held.
The Approach
Step 1. Find everything
The first daily Sentinel scan after the move flagged 37 malicious files, 60 database entries and 3 scheduled tasks. Tracing how they connected turned up four more files.
Step 2. Remove it in one pass, with the site online
We stopped the background process first, then removed 41 files and 63 database entries and scheduled tasks in one pass, so there was no gap for the malware to repair itself. The site stayed online for visitors the whole time.
Step 3. Lock the doors
We deleted the hidden admin account, reset the passwords of all three real administrators, signed out every session, turned off application passwords and changed the security keys WordPress uses to sign logins. Two-factor login was switched on for the site.
Step 4. Prove it stayed clean, then improve it
Sentinel has scanned the site every day since. Then Auto Speed and Auto SEO went to work. Auto Speed took the homepage's mobile score from 83 to 89 and the time until it looks complete from 4.7 seconds to 1.7. Auto SEO wrote 61 image descriptions and 19 page descriptions and lifted the site's SEO readiness from 73 to 91.
The Results
- 41 malicious files and 63 database entries removed, with the site online throughout.
- The hidden admin account deleted and every way back in closed.
- 23 clean daily scans in a row, each covering about 6,300 files, with no reinfection.
- 100% uptime since the move, cleanup included.
- SEO readiness up from 73 to 91 and the homepage's mobile score from 83 to 89.
- First reply to the firm's ticket in two minutes.
Why It Worked
- Scanning every day finds what nobody is looking for. This infection was more than two months old and invisible from the front of the site.
- We removed it the way it was built. Stopping the background process first meant the cleanup held the first time.
- Cleanup is included. The firm did not get an emergency invoice. Malware removal is part of every plan.
Frequently Asked Questions
Did the site go offline during the cleanup?
No. Visitors saw the normal site the whole time.
Does every plan include malware removal?
Yes. Daily Sentinel scans and removal are included on every plan, with no cleanup fee.
How do you know it has not come back?
Sentinel scans the whole site every day. 23 scans in a row have come back clean, and a senior developer looks at any new finding.
The Stack — Named, Not Hidden
We tell you exactly what runs underneath. No proprietary black box.
Business Outcomes
- →Malware that had been on the site since late July was found the day after the move and removed three days later, with the site online the whole time.
- →The hidden admin account it had created was deleted, every admin password was reset, every session was signed out and security keys were changed.
- →23 daily scans in a row have come back clean, each covering about 6,300 files, with no reinfection.
- →Auto SEO wrote 61 image descriptions and 19 page descriptions, taking the site's SEO readiness from 73 to 91.
Founder & Lead Developer
20+ years full-stack development, WordPress, AI tools & agents
Colton is the founder of TopSyde with 20+ years of full-stack development experience spanning WordPress, cloud infrastructure, and AI-powered tooling. He specializes in performance optimization, server architecture, and building AI agents for automated site management.
