The step people skip.
WHY IT MATTERS MOST
Cleaning without closing the entry point means it returns within days.
That is why repeated compromises happen.
WHAT TO CHECK
What was out of date at the time Whether any nulled software is installed Whether credentials were exposed Whether an upload form was exploited Whether another site on the account was compromised
THE MOST COMMON CAUSES
An outdated plugin or theme Nulled software Stolen credentials An abandoned installation elsewhere on the account
WHAT THE LOGS SHOW
Access logs around the time files were modified.
Look for unusual requests, particularly to files that should not be requested.
WHAT THE FILE DATES SHOW
When the first unauthorised file appeared.
Then look at the logs for that time.
IF YOU CANNOT FIND IT
Assume the worst: replace everything, change everything, remove anything unmaintained.
WHAT TO ASK US
We can check server-side logs and may identify it.
Open a ticket with what you have found.
