Making a hacked website safe, and bringing its software up to date

The problem

The attackers got in through an out-of-date plugin. Some appointments were cancelled, clients saw strange links and spam came through the contact form. The site was restored from a backup, but no one had explained how it happened or confirmed it was clean.

There was a second problem. The software the site runs on was years out of date and no longer got security fixes. Every attempt to upgrade crashed the site, because its custom design, built years earlier by another agency, didn’t work with newer versions.

What we did

• Checked every file. WordPress itself and every plugin were compared with clean official copies, and we went through the custom code and every uploaded file by hand.
• Went through the whole database. Every page and post, including drafts, plus all the settings behind the site. We found and removed a hidden tracking script loading on every page, and cleared out data left behind by old plugins.
• Locked the doors. Old admin accounts and server logins removed, two-factor login required for every administrator, and the leftovers of the plugin the attackers used deleted.
• Took back Google. The attackers had made themselves an owner of the site in Google’s tools for website owners. We removed them, checked every page Google had listed and asked Google to look at the site again.
• Moved the domain to a more secure service, with every setting copied across first so the clinic’s email kept working.
• Brought the software up to date. We upgraded a copy of the site first, found everything that broke, fixed it, then upgraded the live site. Menus, layouts and booking links all stayed exactly as they were.

The result

The spam has gone from Google, and Google reports no security issues with the site. It now runs on up-to-date software and the current version of WordPress, with a password-protected test copy for any future changes.