Challenge
What had to be solved
Hacked WordPress sites need cleanup without destroying legitimate files or data.
Solution
What I built or fixed
A repeatable, defensive workflow that puts evidence and backups before deletion.
Technical approach
How the work was approached safely
Isolate, snapshot files and database, verify core checksums, scan plugins/themes/uploads, inspect the database for spam, confirm real malware vs false positives, clean carefully, then harden (WAF, 2FA, disable file editing) and monitor.
Result
Evidence before deletion
A safe, defensible cleanup process. Note: security work reduces risk but cannot guarantee a site is never attacked again.