Three hacked websites, taken back.

01 22 June · What visitors saw

The sites still looked like hers. They weren’t.

Her photos, her prices, her words — all still there. But depending on the site and the hour, a visitor got pop-up ads, a fake “Click Allow” page, a shopping site carrying a stranger’s affiliate code, or nothing but an error. And the login page she used to fix things had disappeared.

02 April → 16 June · The silent part

It began weeks before anyone noticed.

Files planted in the sites were dated as far back as April. Working back doors — small programs that let an outsider upload and run anything — were in place by early May. Then, on 16 June at 09:33, all three websites were altered within the same seven seconds.

03 22 – 23 June · The first 48 hours

Get back in. Then touch nothing.

The first job wasn’t fixing anything. It was getting control back, and preserving the evidence exactly as it was — without ever letting the infected code run again.

04 23 June · Inside the files

Only 29% matched the official core.

The snapshot was compared, byte for byte, with the official core releases. 29,396 matched exactly. The other 73,709 included extensions, custom content and confirmed attack code. A mismatch alone does not mean a file is malicious.

05 23 – 25 June · The decision

For these sites, rebuilding was the sounder choice.

The audit found widespread changes, hidden back doors and damage left after an earlier cleanup. For this case, rebuilding gave us a clearer basis for trust. Only reviewed words and pictures were carried across. Other sites may be suitable for a targeted repair.

06 23 June → 2 July · Rebuilt from the blueprint

The old site became a drawing, not a foundation.

Each page was rebuilt one at a time from the evidence — layout, menus, text, spacing, the exact size and position of every picture — to preserve the familiar visitor experience while replacing the compromised implementation.

07 30 June · A new foundation

Fewer places for an attack to take hold.

The old sites ran programs on the server for every visit, with a database behind them and 187 add-ons that all needed updating. The new ones are finished pages, delivered from a global network. Editing uses a separate sign-in. The editor, hosting accounts and dependencies still need to be maintained.

08 30 June → 1 July · The move

Moving house without losing the post.

Her web addresses were pointed at the new sites while email kept flowing to the mailbox it always had. One old setting would have quietly taken the email along with the website — it was split off before the switch.

09 July → August · Checking the other doors

The break-in didn’t stop at the websites.

One of her email accounts had been signed into from abroad. The review identified seventeen accounts needing password and sign-in checks. And the old server still held leftovers in places no website uses.

10 August · Cleaning up Google

The hacker’s pages outlived the hack.

The August case record reports 10,356 Google results for one site, with attacker pages in 967 of the 1,000 results sampled. Removed addresses were given not-found or gone responses, and the real pages received titles, descriptions and structured data. The animation illustrates the intended cleanup, not a measured search-ranking result.

11 6 July → 14 October 2026 · The keys, handed back

Now she edits her own sites.

She logs in with her email, changes a sentence or adds a photo, and presses Save. About a minute later it’s live — and every save is kept as a version that can be restored. She can change the words and the pictures. The editor keeps routine content changes separate from the page layout.

12 July–October · Still looking after it

Looking after a site means noticing the small things.

↺ Summary

Before and after.

→ What this kind of work involves

Six things, done carefully.