Malware in a WordPress backup, disguised as a photo A client wanted me to restore a WordPress site from a zip backup and asked for one thing before paying: a screenshot of the site running on my own computer, with localhost in the address bar.

Loading a WordPress site runs its PHP on whatever machine serves it. So I read the zip with a script first and didn't extract it.

WordPress core matched the official checksums. In wp-content/mu-plugins, though, there was a file that looked for a 4.6 MB "JPEG" in uploads, renamed it to .exe and tried nine ways to launch it. The first two bytes of that "JPEG" were MZ, which is how a Windows executable starts. Opening localhost for the screenshot would have been enough to run it.

My first script missed it because it trusted file extensions. Now it reads the first bytes of every file.

The write-up has the loader code and the checks I now run before importing a backup I didn't make. If the same file reached you, the SHA-256 hashes are at the end. https://helban.dev/en/case-studies/fake-wordpress-backup-malware/

The MZ check is such a good catch. Worth adding for anyone restoring sites: mu-plugins run on every request and can't be switched off from the dashboard, so they're a favourite hiding spot. Did the client ever reply after you flagged it?

Fix your images first

On a slow site, images are often the heaviest files on the page.

Fix them in this order: → Resize them to the size they're shown at (no 4000px photo in a 600px box) → Convert to WebP or AVIF → Lazy-load anything below the first screen → Give every image a width and height, so the page doesn't jump → Preload the hero image instead of lazy-loading it

How heavy is your hero image? Check it in your browser's DevTools and tell me the size below.

#WebsiteSpeed #PageSpeed #CoreWebVitals #WebPerformance #WordPress

Good order. I would add one thing from client sites, the hero is usually a 4000px upload used in a 600px box, and resizing it alone often fixes the LCP score. Preloading the hero instead of lazy loading it is the detail most people miss. Checking mine after this.