Online casino spam has been without a doubt one of the most prevalent types of spam content that we’ve seen on infected websites in recent years. An extremely common method of promoting low-quality or otherwise undesirable websites is for spammers to hack websites and fill them full of backlinks to pump their SEO. Historically this […]
Tag Archives: WordPress Security
Vulnerability & Patch Roundup — October 2025
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises. To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this […]
Contact Form Spam Attack: An Innocent Feature Caused a Massive Problem
How a simple “Send a copy to yourself” feature led to 149,700 spam emails and what you can do to prevent it The Emergency Call It started like many server emergencies do – with a panicked message about massive server performance issues. A client’s website was grinding to a halt, CPU usage was through the […]
Malvertising Campaign Hides in Plain Sight on WordPress Websites
Recently, one of our customers noticed suspicious JavaScript loading across their WordPress website. Visitors were being served third-party scripts that the site owner never installed. After investigation, we discovered the infection originated from a malicious modification in the active theme’s functions.php file. This injected PHP code silently fetched external JavaScript from attacker-controlled domains and inserted […]
Vulnerability & Patch Roundup — September 2025
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises. To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this […]
Hidden WordPress Backdoors Creating Admin Accounts
During a recent cleanup of a compromised WordPress website, we discovered two different malicious files designed to silently manipulate administrator accounts. Attackers often inject such backdoors to maintain persistent access to a site, even if their other malware is detected and removed. These files were disguised to look like regular WordPress components, but their functionality […]
Choosing the Best CMS for Your Needs
Knowing which is the right CMS is key when launching a new site. Websites are no longer just online brochures; they’re where businesses sell products, protect private information, chat with customers, and build their entire online brand. A good CMS gives you flexibility, room to grow, and strong security, so you can easily manage your […]
Vulnerability & Patch Roundup — August 2025
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises. To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this […]
Locking Down the WordPress Login Page
Due to its flexibility, ease of use, and massive plugin ecosystem, WordPress is a favorite among bloggers, developers, and businesses alike. Given its popularity, attackers do not waste time guessing where sensitive assets live. By default, on every WordPress site the front door is conveniently labeled /wp‐login.php or /wp‐admin/. On even a modest site, server […]
Malicious JavaScript Injects Fullscreen Iframe On a WordPress Website
Last month, we came across an ongoing JavaScript-based malware campaign affecting compromised websites. The malware injects a fullscreen iframe that silently loads content from a suspicious external domain. This type of malicious script aims to force users to view unsolicited content, often for ad fraud, traffic generation, or deceptive social engineering. This is the fake […]
