Performing arts education, New Zealand
Finding and Removing a Hidden Backdoor Before It Was Exploited
Routine monitoring flagged unusual server behaviour on a client's website. Instead of assuming it was a simple performance issue, we investigated properly — and found a disguised plugin quietly functioning as a backdoor.
The challenge
The site was intermittently slow and showing signs that didn't fully match normal WordPress behaviour. Rather than just clearing caches and moving on, we treated it as a possible security issue and investigated at the server level.
What we did
- Connected directly to the server to inspect real files and the database, not just the WordPress admin screen — which a compromised site can't be trusted to report honestly
- Identified a disguised plugin functioning as a backdoor, confirmed it had zero legitimate use on the site, and removed it
- Verified the core site configuration was clean and no other unauthorised access points existed
- Separately root-caused a recurring slow/unresponsive server issue to genuine memory pressure — partly normal traffic, partly our own monitoring checks running too aggressively — and corrected the monitoring pacing
The outcome
- Backdoor fully removed and independently reverified through a second server check, not just assumed fixed
- Site confirmed healthy and stable throughout, with no evidence the vulnerability had been exploited
- Monitoring adjusted so it observes the site without contributing to the same load problem it exists to catch