Sample after-action report

1. Summary

A WooCommerce site on shared cPanel hosting began serving redirects to an offsite “deal” page for visitors arriving from Google on mobile. Direct visits and logged-in admins saw nothing unusual, which is why the owner first heard about it from a customer rather than from monitoring.

The site was cleaned in place. No rebuild was required. Orders placed during the incident were unaffected; card data is handled by the payment gateway and never stored on the site.

2. Timeline (from available logs)

• Day −14 — First appearance of an unfamiliar PHP file in wp-content/uploads, matching a known dropper pattern.
• Day −13 — Two administrator accounts created four minutes apart from the same address block.
• Day −11 — Conditional redirect injected into the active theme’s functions.php and a must-use plugin.
• Day 0, 10:42 — Owner reports customer complaints; triage begins.
• Day 0, 11:05 — Full snapshot taken (files + database) before any destructive change.
• Day 0, 13:20 — Cleanup complete, credentials rotated, site verified clean from three test networks.
• Day 1 — Google Search Console security review filed. Warning cleared on Day 3.

3. How they got in

A file-upload vulnerability in an abandoned gallery plugin (last updated four years ago, still active) allowed an unauthenticated write into the uploads directory. The plugin had a public advisory nine weeks before the first malicious file appeared.

This is the finding that matters most: nothing about the host, the theme, or WordPress core caused this. One unmaintained plugin did.

4. What was removed

• 7 malicious PHP files across wp-content/uploads and one must-use plugin.
• Injected redirect code in the active theme’s functions.php (restored from the vendor’s clean copy).
• 2 rogue administrator accounts, plus one scheduled task re-adding them nightly.
• 38 injected rows in wp_options and wp_posts serving spam markup to search engines.

5. What was rotated and patched

• All administrator passwords, WordPress salts and keys, database user password.
• cPanel password and every FTP/SFTP account; two unused accounts deleted.
• WordPress core, 14 plugins, and the theme updated; the vulnerable gallery plugin removed and its shortcodes replaced.
• File permissions corrected; PHP execution blocked in the uploads directory.

6. Search and reputation

• Google Search Console: security issue review requested Day 1, cleared Day 3.
• Safe Browsing and two domain blacklists rechecked; one listing required a reconsideration request, cleared Day 4.
• Sitemap resubmitted; 61 spam URLs returned 410 and dropped out of the index over the following two weeks.

7. Open items for the owner

• Decide on a replacement for the removed gallery plugin, or accept the simpler built-in layout now in place.
• One shared “office” administrator login is still in use by three people; split into named accounts.
• No backup existed that predated the compromise. Backups are now running, but the next incident will go better if they are also monitored.

8. What this report does not claim

We cannot prove with certainty that nothing else was taken. The logs available on this host cover a limited window, and an attacker with write access could have read anything the site could read. What we can say is what the evidence shows, what was removed, and what is now closed.

We also cannot promise that a search engine or blacklist clears a warning on a schedule. We file the requests, then monitor and tell you when they clear.