Client's WordPress site kept getting reinfected even after deleting the malicious files — here's what was actually going on

Had a client come to me a few weeks ago in a bit of a panic. Their WordPress site kept "recovering" from hacks — they'd find a shady file, delete it, site would look clean for a day or two, then boom, spam redirects or a defaced page again. They'd been going in circles with this for almost two weeks before reaching out.

First thing I always do in these cases: assume the visible malware is not the actual problem. If a shell script survives a "cleanup," there's almost always a second (or third) foothold you haven't found yet. Deleting the obvious backdoor just resets the timer.

What I found on this one:

A malicious file disguised with a legit-sounding name sitting in wp-content/uploads (a directory that's writable but rarely gets audited since it's "just media")

A cron job silently re-downloading the payload every few hours — this was the actual reinfection vector, not a new "hack"

A rogue admin user created weeks earlier that nobody had noticed, which was regenerating the malicious files whenever they got deleted

Obfuscated code injected into a legitimate theme file (base64 encoded, hidden between normal-looking function calls) acting as a second backdoor

The lesson that I think a lot of people miss: cleaning a hacked site isn't about deleting the file you found — it's about mapping every persistence mechanism (cron jobs, rogue users, modified core/theme files, scheduled tasks) before you declare it clean. Otherwise you're just playing whack-a-mole with an attacker who has more patience than you do.

Full remediation ended up being: rotate every credential (DB, WP admin, SFTP, hosting panel), audit every user account, diff the entire WP install against clean core files, lock down file permissions, and put a WAF + file integrity monitoring in front of it going forward.

Anyone else run into the "cleaned it but it keeps coming back" pattern? Curious what other persistence tricks you've found in the wild — always good to know what to check for.

A B2B SEO Case Study

A B2B packaging client came to us a year and a half ago with a site that looked good but wasn't earning a single click. 2-3 organic clicks a day. That was the entire search presence for a company that depended on inbound leads to grow.

This wasn't a quick fix. It was a long-term SEO plan we built and executed over 18 months, working closely with their content and dev teams at every stage.

We started with the foundation. The site was built on a JS framework optimized for design, not for search engines, so a lot of the content was effectively invisible to Google. We worked directly with their dev team to rebuild how the site rendered and served content so it could actually be crawled and indexed properly.

Once the technical base was solid, we moved into strategy. We ran competitor analysis to find where they were losing visibility and where the real opportunities were sitting untouched. From there, we built a content roadmap with their content team, targeting the terms their actual buyers were searching for, and kept refining it every month based on what was working and what wasn't.

None of this was one campaign or one sprint. It was a continuous cycle: audit, fix, publish, measure, adjust, repeat, for a year and a half straight.

Where they are today:

- 40,000+ search impressions a day

- 140+ organic clicks a day

- 10+ organic business leads a day

All without a cent of paid spend

This is what SEO actually looks like when it's done right. Not a hack, not a shortcut. A real plan, executed with the client's own team, sustained long enough to compound.