A single entry point caused a year of reinfections with over 383 malware files.

The Problem

A shared-hosting account contained 7 domains: 3 active sites and 4 inactive or abandoned WordPress installs. The account was actively compromised. A cleanup three years earlier had removed 227 infected files but never closed the original entry point, allowing attackers to keep reinfecting the account from May 2024 onward.

HostGator's ClamAV scanner had found only 247 of the 383+ infected files, leaving more than 130 behind. The goal was therefore not just to run another malware scan. I needed to find how the attackers were getting back in, remove the remaining infection, and harden the account so the same cycle would not simply start again.

What I Found

I found 383+ infected files across the account. ClamAV had detected 247 but missed 136, while a second audit uncovered another 87 files that had escaped the first pass. These included obfuscated PHP, hidden dot-files, and PHP files inside upload directories. The timestamps showed continuous planting activity from May 2024 through January 2025.

The Fix

I started with cleanup and recovery. I freed 8.5GB of disk space and backed up every wp-config.php before removing the injected code and locking the files to chmod 444. I removed the 3 hidden CSS backdoors, the entire 93-file attacker-controlled domain folder, and the 247+ malware files already identified by the scanner.

The 8 fake plugin/theme directories and 8 rogue admin accounts were removed. I deleted the rogue database user, rotated the database password, and updated every wp-config.php with the new credentials. I also removed the old Duplicator 2019 installer, cleaned rogue WP Fastest Cache references, added Wordfence for monitoring, and removed backdoor code from the Goodlayers theme.

The 3 inactive WordPress sites were removed after their database backups were exported. On the remaining sites, .htaccess rules were added to block xmlrpc.php, PHP execution inside uploads, and access to backup and configuration files.

The Result

The account went from an actively reinfected environment to a hardened setup with 383+ malware files removed and the original entry point closed. The 3 active sites now have Cloudflare WAF protection, Wordfence monitoring, locked file permissions, and corrected SPF, DKIM, and DMARC records.

The 3 inactive sites were removed after their databases were safely backed up. The rogue database account was deleted and credentials were rotated. Most importantly, the underlying reinfection path was closed instead of simply cleaning the symptoms again.

Every change was documented with rollback steps, and the client received a PowerShell IP-allowlist tool they can continue using themselves. The result was not just a clean account, but a setup designed to make another year-long reinfection much harder.