Compromised WooCommerce Store Cleaned & Hardened in Under 24 Hours

Client details anonymized. Timeline and findings are representative of the engagement.

The situation

The owner of a WooCommerce store got the worst kind of morning: customers reporting that the site redirected them to a spam page, Google flagging the domain, and the store — their primary sales channel — effectively offline. A malware-scanner plugin had already "cleaned" the site once the week before. The infection came back within days.

That detail was the most important clue: when a cleanup doesn't hold, the backdoor was never found. Scanners remove the visible payload; they don't find how the attacker gets back in.

The response

Hour 0–2: Contain and preserve
Full snapshot of files and database for forensics. Admin passwords and salts rotated, suspicious admin sessions killed, and the database user password changed. The redirect payload was neutralized so customers were no longer being sent to spam pages while the investigation continued.

Hour 2–8: Find every way in — not just the obvious one
Manual audit of the codebase against clean WordPress/WooCommerce/plugin sources, including running wp core verify-checksums. Crawl of upload directories and full review of the database for injected content and users. Findings:

• Backdoor #1: An injected file uploader disguised with a core-like filename inside wp-includes — the one the scanner plugin kept missing.
• Backdoor #2: A modified legitimate plugin file executing attacker-supplied code via an innocuous-looking request parameter.
• Backdoor #3: A rogue administrator account with a deliberately unremarkable name, created weeks earlier — persistence that survives any file cleanup.

Root cause: An outdated plugin with a known vulnerability had let the attacker in the first time. Every "cleanup" that didn't patch it was an open invitation to return.

Hour 8–20: Clean rebuild of the infected layers
Core, theme, and plugins reinstalled from clean sources. Database swept for injected admin users, options, and scripts. The vulnerable plugin was updated. All secrets, API keys, and the database user password were rotated.

Hour 20–24: Harden and restore trust
File permissions locked down, PHP execution disabled in upload directories, server configuration reviewed, WAF rules and login protection added, and automated off-site backups configured. Review requests submitted to Google — the "this site may be hacked" warning cleared shortly after.

The outcome

• Three backdoors removed — including the two that automated scanning had missed twice.
• The actual entry point closed, so the cleanup held. No reinfection since.
• Store back online and clean in under 24 hours, blacklist warnings cleared, checkout verified end to end.
• The owner walked away with a written incident report: how the attacker got in, everything that was found, and what now prevents a repeat.

What this case teaches

1. Reinfection means a missed backdoor. If your site was "cleaned" and hacked again, someone treated the symptom.
2. Attackers plant more than one way back in. Files, database, and user accounts all need auditing.
3. The cleanup is half the job. Without patching the entry point and hardening, you're renting your site back from the attacker.

---

If your store or site is showing the same symptoms, this exact engagement is my Emergency Cleanup service — $349 fixed, typically under 24 hours, with a 30-day reinfection guarantee.