A hundred hacked sites on Friday. All in order by the end of the weekend.

Friday afternoon. Of course.

One of our agency partners got in touch: around a hundred of its WordPress sites had been hacked.

How one breach became a hundred

The sites ran on a cPanel server, every client in a single folder. From PHP, each site could reach all the others. So when one was hacked, they were all hacked.

And the bonus: every available backup was infected too. The usual escape route, “just restore last week”, was gone.

The real deadline: who tells the clients first

What was at stake was the agency’s reputation. If its clients discovered the problem on their own, that is a loss of trust. If the agency told them first, that it had happened and was already fixed, that is professionalism.

The brief was short: a new server, every site put right, SOS mode, cost is not an issue. We admit it, that is our favourite combo.

Our weekend

• We started over the weekend, after hours.
• We moved all hundred sites to a new server.
• We restored every one of them properly, despite the infected backups.
• Since then, we have been updating and maintaining them continuously.

The agency got to tell its clients first

By the end of the weekend all hundred sites were in order. The agency could go to its clients itself, with the problem already solved.

Not a single site has been hacked since.

Open source is not the weak point

WordPress is open source, which cuts both ways. Anyone can look into the code, so bugs come to light faster, and for the same reason they get fixed faster. The one thing that matters: you have to update regularly.

Three lessons from one weekend

• If every site lives in one folder, one breach takes them all. Sites have to be separated from each other.
• A backup is only worth something if it is clean. Restore from an infected backup and you get an infected site.
• Updating is the cheapest security there is. Fixes for open source bugs arrive fast. You just have to install them.