Closing the loop.
WHAT TO DO IMMEDIATELY
Update everything Remove anything unmaintained Remove nulled software Enable two-factor authentication Set up backups off the server Set up monitoring
WHAT TO ESTABLISH
A maintenance routine Who is responsible
WHY COMPROMISES RECUR
The entry point was never closed Updates resumed being neglected The same nulled software was reinstalled
WHAT TO AUDIT
Every application on the account Every plugin and theme Every user account Every cron job Every FTP account
WHAT TO REMOVE
Anything you cannot account for.
WHAT TO CHANGE ABOUT YOUR HABITS
Updates as routine, not as a response to problems.
WHAT TO RECORD
What happened, what caused it, what you changed.
That record matters if it happens again.
WHAT TO TELL ANYONE ELSE WITH ACCESS
What changed and why.
