Skill · Security
Website security and malware removal work I have been hired to do
I am a Jetpack Security Partner, and malware cleanup has been part of my listed skill set since I started. But the jobs that matter most are rarely dramatic. They are usually about access: who still has it, what they are still being told, and whether anybody has checked since the last developer left.
This is defensive work. Audits, hardening, cleanup, monitoring and reporting, on sites I am authorised to work on.
418
User accounts enumerated and reviewed on one offboarding job
844
Login attempts on non-existent usernames in one reported month
738
Requests blocked by the firewall in that same month
$6.7k
Discount abuse found on one store during an unrelated audit
- Accreditation
- Jetpack Security Partner. Malware cleanup on the skill list since 2015.
- Incident work
- Malware removal, post-compromise hardening, and finding how they got in.
- Audit work
- Users, roles, application passwords, sessions, API keys, webhooks, alert routing, agency offboarding.
- Tools
- Wordfence, MalCare, Jetpack Security, WP Activity Log, direct database and filesystem review over SSH.
- Reporting
- Monthly security reports for clients who answer to a board or a regulator, client identifiers anonymised.
- Engagement
- Incident response, one-off audit, or retained monitoring and reporting.
What I am usually asked for
- Malware cleanup and post-compromise hardening
- Access audits: users, roles, application passwords, sessions, API keys, webhooks
- Offboarding a previous developer or agency properly, with evidence
- Firewall configuration and operations, and removing the ones fighting each other
- Two-factor enforcement and admin account hygiene
- Monthly security reporting for clients who have to answer to a board or a regulator
- Investigating a specific worry: strange logins, unexplained emails, suspicious traffic
- Secrets hygiene: finding live API keys sitting in database dumps and exports
How I work
Read-only first, always. On a security engagement the first thing I produce is a factual picture of what exists, before anything is changed, because changing things destroys the evidence of what was wrong.
Then findings in priority order with the risk stated plainly, remediation proposed for approval, and the changes applied with backups and a written record.
If the honest answer is "this is not an attack, it is a search engine crawler and your real problem is elsewhere", that is what I will tell you, even though it is a less impressive answer.