Security & hardening

Hacked, slow for no reason, or flagged by Google? Let's find the cause.

I trace what's actually happening on the server through processes and logs, clean it up, then close the door it came through, so it doesn't come back next week.

Report an incident →Request a security check

Services

What I do

Cleanup after a hack

Searching for backdoors, hidden folders and modified files, and reading the logs to understand how the attacker got in.

Protection from attacks

Blocking XML-RPC abuse and PHP execution in cache and uploads folders, fail2ban, and nginx rate limiting for logins and checkout.

Security audit

Plugins, leftover tools and exposed files that shouldn't be public, plus ad-hoc checks when something looks wrong.

Incident response

Google Safe Browsing warnings, malicious processes and crypto-miners that keep coming back.

How it works

Understand first, then clean

01
Contain
Stop the damage: block the attacker and the malicious processes, without destroying the evidence of how it happened.
02
Find the cause
Logs, file changes and processes. A cleanup without a cause is just waiting for round two.
03
Harden
Close the entry point and add protection, then tell you plainly what was confirmed and what remains a likely cause.

Real work

Recent security jobs

The same UK store, a few weeks later

Card testing attack on checkout

2.7→1.3server load

Problem: Checkout was hammered with fake payment attempts.
Cause: About 9,300 POST requests from one source testing stolen cards, plus a headless scraper.
What I did: Blocked the source and the headless scraper
Added nginx rate limiting on checkout at 2 requests per second
Result: Load dropped from 2.7 to 1.3 and the fake orders stopped.

CloudPanel server, around 18 WordPress sites

Compromised server hosting ~18 sites

4.24→0.79server load

Problem: All four CPU cores were stuck at 100%.
Cause: One compromised site: 5,095 hidden folders and an active backdoor.
What I did: Traced the load to the infected site through processes and logs
Found the hidden folders and the backdoor
Blocked PHP execution in paths where it should never run (cache, uploads)
Result: Load dropped from 4.24 to 0.79.

Node.js application server

Crypto-miner that kept coming back

Problem: An XMRig miner reappeared even after the app had been migrated.
Cause: The likely source was an npm postinstall hook in the project's dependencies.
What I did: Tracked the miner process back to how it was being started
Identified the npm postinstall hook as the probable entry point
Result: Likely cause identified, so it could be removed at the source instead of after every deploy.

Tools and stack

fail2ban
nginx rate limiting
Log analysis
Malware cleanup
Google Safe Browsing

Something looks wrong right now?

Tell me the domain and what you're seeing. Don't send passwords in the form; if I need access, we'll agree on a safe way.

Report an incident →