WordPress Website Recovery After a Hack

Client:

Hookah products online store

Industry:

E-commerce / Retail

Focus:

Comprehensive security audit and recovery of a hacked WordPress website

Main challenge:

Detect and remove hidden malicious code and eliminate attacker access

Market:

Ukraine

Services provided:

WordPress Security Audit (White-box)

Key Takeaways

Backdoor infections and web shells were completely removed.

9 unauthorized admin accounts were removed.

11 critically vulnerable plugins were uninstalled.

The risk level was reduced from high to medium.

Recommendations were provided to reduce the risk of account compromise by 80%.

vulnerable plugins removed

5 days

project duration

unauthorized accounts removed

Upd: 04.08.2026 4 min

When hidden malicious code was discovered on an online store, customer data, business reputation, and every transaction were at risk. This case study shows how Datami investigated the compromised WordPress system, removed the malware, and restored security in 5 days.

A small WordPress-based online store selling hookah products serves hundreds of customers each month.

Its cybersecurity is directly tied to customer protection, as the platform stores names, delivery addresses, and payment data. A data breach can cause financial losses and reputational damage.

Project tasks and challenges

The client contacted Datami immediately after discovering the website had been hacked. The attackers had gained hidden access to the system and could modify files, read the database, or control the server.

Without rapid intervention, customer data and the uninterrupted operation of the online store remained at risk.

Investigate the compromised system and identify all unauthorized access points.
Completely remove malicious code and restore file integrity.
Provide a detailed report and a future security plan.

Infection analysis

Investigation of infected files, the database, and attacker entry points.

System cleanup

Removal of malicious code, restoration of website files, and removal of unauthorized accounts.

Report and recommendations

Detailed findings and a step-by-step security improvement plan.

Our approach

The Datami team conducted a White-box audit using malware analysis, file integrity checks, database forensics, and CVE vulnerability mapping.

All WordPress components were examined, including core files, plugins, themes, databases, and media uploads.

Automated scanning was combined with manual code review.

WP-CLI, grep, find, Filescan, and MySQL were used to detect malware and analyze the system.

Security best practices

Applied a website audit methodology based on WordPress security best practices.

PHP code analysis

Used PHP code analysis to identify malicious and obfuscated code.

Regular expressions

Used regular expressions to detect malicious code patterns.

Key project phases and solutions

The team provided daily updates and coordinated every key decision with the client.

Throughout the project, the priority was to keep the online store operational and prevent the loss of order data.

Detection and investigation

Found signs of compromise, including unknown files, modified system components, and heavily obfuscated malicious code with a self-restoring mechanism.
System cleanup

Replaced core files with clean copies, disabled the self-restoring mechanism, and removed unauthorized accounts and vulnerable plugins.
Root cause analysis and reporting

Developed measures to prevent future attacks and prepared a detailed report.

Results and recommendations

At the start of this cybersecurity project, the situation was critical: attackers had full control of the website, 11 plugins contained critical vulnerabilities, and 9 unauthorized administrator accounts were found in the database.

Following the audit, the risk level was reduced from high to medium. The system was fully cleaned, and attacker access was blocked.

The client received the following recommendations:

Install a security monitoring plugin (Wordfence or Sucuri).
Enable two-factor authentication for all administrators.
Deploy a Cloudflare web application firewall to block up to 95% of automated attacks.
Configure daily automated backups stored in a separate location.
Restrict admin panel access by IP address.
Disable the unused XML-RPC remote access protocol.

The client immediately enabled two-factor authentication and deployed the DataGUARD security monitoring service.

Key project results

In just 5 days, the Datami team fully restored the security of the compromised online store by investigating the attack, removing self-restoring malware, closing all identified entry points, and protecting customer data from leakage.

This case shows that even small WordPress stores can become attractive targets. A timely security audit costs far less than recovering from a breach and rebuilding customer trust.

Metric

Before the project

After the project

Risk level

High - attackers had full system access

Medium - access blocked, system cleaned

Malicious code

Active, with a self-restoring mechanism

Completely removed

Unauthorized admin accounts

9 unauthorized accounts in the database

All removed, access restricted

Vulnerable plugins

11, including 3 with critical severity

Removed, attack vectors eliminated

Website system files

Modified by attackers

Restored to their original state

More success stories with Datami

Browse other project case studies

Cloudflare Zero Trust & SIEM for SaaS

MTTD reduced to 1–2 hours
False positives reduced by 50–65%

Services:

Cloudflare Zero Trust and Wazuh SIEM implementation

Aug 4, 2026

SIEM Wazuh Implementation for a Financial Company

PCI DSS & ISO 27001 audit-ready
Reduced false positives by 60–70%

Services:

SIEM Implementation (Wazuh)

Jul 1, 2026

Blockchain Project Security Audit

Audited 9,000+ lines of Rust code
Project certified by Datami

Services:

Blockchain security audit

Jun 30, 2026

Back to home page

Datami articles

When AI Meets Smart Contracts: How Prompt Injection Creates a New Web3 Attack Surface

Oleksandr Filipov

When AI Meets Smart Contracts: How Prompt Injection Creates a New Web3 Attack Surface

A smart contract can pass the most rigorous audit and the product around it can still be exposed. All it takes is an AI reading on-chain text as a command. A new class of Web3 risk, from a real Datami finding.

3 min Aug 3, 2026

Cybersecurity Risk Self-Assessment: 6 Gaps Fintech Companies Notice Last

Oleksandr Filipov

Cybersecurity Risk Self-Assessment: 6 Gaps Fintech Companies Notice Last

Most companies learn about their weak spots not from their own team, but from a due diligence partner or an attacker. We explain which gaps in fintech remain unnoticed the longest and why.

4 min Jul 27, 2026

Cyber Risk Self-Assessment: 20 Questions for Fintech Companies

Oleksandr Filipov

Cyber Risk Self-Assessment: 20 Questions for Fintech Companies

We offer a free cybersecurity self-assessment questionnaire, developed from Datami’s 9 years of experience in pentesting for financial sector organizations.

5 min Jul 15, 2026

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on datami.ee and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.