Getting a hacked membership site back, and checking every membership against Stripe

The problem

A fake “security check” screen was covering the site, so members were locked out. It had been put into maintenance mode, but the fake screen still loaded on top. The site had been built and patched by different people over many years, and the hosting was still in a previous agency’s account.

There was also a longer-running worry. Some members had their memberships cancelled without asking, and the owner couldn’t be sure everyone was being charged correctly. The owner didn’t want to spend money marketing memberships until she could trust the system behind them.

What we did

• Found the way back in. The infected files came back every time they were removed, so the attackers still had a route in. We shut off every admin account but ours while we tracked it down, then gave the team their access back.
• Got the hosting into the owner’s hands. They now have their own access instead of going through the previous agency.
• Checked every membership against Stripe. We compared every active member with their subscription. Some had access with no live subscription behind it, so we grouped them by reason: subscriptions that ended without access being closed, memberships added by hand, and people from old one-off offers.
• Changed nothing without asking. Some of those accounts are there on purpose, so the owner got the list to decide on before anyone lost access.
• Fixed the member menu, which showed more than once for members in more than one group.
• Stopped the unexpected cancellations. We reviewed and tidied up the membership rules, which let us trace the cancellations back to how some subscriptions were set up on the site, and put that right.

The result

The site is clean, members can log in again and new sign-ups and free trials work as they should. For the first time, the owner has a clear list of who has access and why, so they can market memberships knowing the billing behind them works correctly.