Guides
Each guide starts from a symptom owners actually search for, explains what is really happening, shows how to confirm it safely, and sets out what a complete fix requires. Written from real incident work — free to read, with no email, form, or account.
The guides
Symptom · Fake verification page
A fake CAPTCHA or Cloudflare-style check on your own site means it is compromised and serving ClickFix malware to your visitors. How to confirm it without infecting yourself, and why deleting one file never removes it.
Read the fake-verification guideSymptom · Spam redirects
Visitors land on ads or scam pages while the site looks normal to you — the signature of a cloaked redirect hack. Where the redirect hides, how to reproduce it under the victim’s conditions, and what a durable fix involves.
Read the redirect-hack guideSymptom · Repeat infection
A site that is reinfected after every cleanup is not unlucky — something survived. The five places most cleanups never check, from database persistence and PHP startup directives to identities and neighboring sites.
Read the reinfection guideSymptom · Japanese search results
Japanese titles and counterfeit-goods pages under your domain in Google are the Japanese keyword hack: cloaked SEO spam generated on your site. Where it hides, why deleting pages fails, and how the index recovers.
Read the Japanese keyword hack guideSymptom · Browser warning
The red Safe Browsing warning means Google saw your site serving deceptive content. What triggered it, why review-before-cleanup backfires, and the removal sequence that works the first time.
Read the warning-removal guideSymptom · Unknown account
Accounts do not create themselves. A rogue administrator is persistence from an active compromise — what to capture before deleting anything, how to find hidden siblings, and the response that closes the door.
Read the rogue-admin guideSymptom · Card fraud reports
Checkout skimming steals card data while every order still succeeds. The signals that reveal a skimmed WooCommerce checkout, how to confirm it without destroying evidence, and the obligations that follow.
Read the checkout-skimming guideSymptom · Hosting suspension
The suspension notice lists flagged files and asks you to clean and reply. Deleting them gets you reinstated — and re-suspended. What the host actually knows, what to ask for, and the sequence that lifts a suspension once.
Read the hosting-suspension guideServer · WHM / cPanel
One account flagged on a shared control-panel server is a server incident. Why per-site scans miss the mechanism, what to preserve and contain first, and the root-level sweep that decides whether the incident is really over.
Read the WHM/cPanel response guideServer · gsocket backdoor
A packed binary hiding in ~/.config/htop is a gsocket backdoor — an encrypted outbound shell that survives every site cleanup. How to check each account, confirm it without running it, and remove it in the right order.
Read the gsocket backdoor guideAlert · ImunifyAV
A detection list is an inventory of damage, not an account of the mechanism. How to read a detection name, tell a real finding from a false positive without guessing, and understand what a clean result does not cover.
Read the ImunifyAV detections guidePersistence · PHP startup
A PHP auto_prepend_file directive runs before WordPress and before every plugin inside it, so it can rewrite what you just removed. Where it hides, how to tell it from Wordfence's legitimate use of the same setting, and the removal order that holds.
Read the auto_prepend_file guideContradiction · Clean scan
A clean scan and a live warning are not a contradiction — there are four reasons they coexist, and they need completely different responses. How to tell which one you have before you request a review.
Read the clean-scan triage guideAssurance · Cyber insurance
Insurer questionnaires are answered under a duty of accuracy, and most are written for a company with laptops. What each question means for a site and its server, and what evidence actually answers it.
Read the cyber-insurance guideConfiguration · Cloudflare
If the origin server answers direct requests, every WAF rule is optional for an attacker who finds its address — and addresses leak through DNS history, subdomains, and email. How to check and close it.
Read the origin-exposure guideResource · Free download
The control areas a professional audit reviews — access, software, hosting, recovery, monitoring — as a checklist you can run against your own site. Free HTML and PDF, no email required.
Open the audit checklistDeeper reading
The guides draw on documented engagement work: a coordinated ClickFix infection investigated across more than 30 WordPress and WooCommerce sites, a hidden ELF backdoor found on a 261-account WHM server after every scan came back clean, and an e-commerce site whose reinfection cycle ended only when the surviving persistence and access paths were closed.