On the EspaDent website, we removed detected malicious code, restored WordPress files and strengthened upload protection. This case study separates cleanup, component updates and availability checks. The main work described here took place in August 2026.
Project website: EspaDent
Initial task
The project review began with access, then moved on to files and server settings. The working materials describe suspicious executable files and the rules that allowed them to be launched.
It was necessary to remove the detected threats and check the operation of the site after restoration. The presence of a malicious file, the log of access to it, and the reason for the initial penetration are different issues; The source of the attack has not been identified according to available data.
Work and documented results
| Work | Result | Period or source |
|---|---|---|
| Malware removal and recovery | 1 website recovered | August 2026 |
| Website component updates | 8 plugins updated | August 2026 |
| Upload protection | 2 protection layers configured | August 2026 |
Malware removal and recovery
1 website recovered · August 2026
We removed detected malicious code, restored WordPress files and checked the database, homepage and admin login.
We removed the detected malicious code, restored WordPress system files, and checked the database, home page, and admin login.
Administrative access also needs separate attention during recovery. Unknown accounts and excessive permissions require investigation: restoring files alone does not remove access that an attacker could use.
We checked not only the found files, but also the conditions for their execution. This is important because deleting one file leaves a problem if another path remains for the code to run or reappear.
Website component updates
8 plugins updated · August 2026
We updated available plugins and restored WordPress system files. Then checked core integrity and database operation.
We updated eight available plugins and restored WordPress files. Afterwards, we checked core integrity and database operation.
The component update was accepted along with a site check after the change. Successful completion of an update does not in itself ensure that all features are compatible and that the pages are free of errors.
Upload protection
2 protection layers configured · August 2026
We blocked script execution in the uploads folder and configured checks for dangerous file extensions and PHP code.
We configured two layers of protection: blocking script execution in the uploads directory and checking uploaded files for dangerous extensions and PHP code.
Uploaded files were checked separately from the theme and plugins. A directory intended for user content should not become another place where server code can execute.
Screenshots show the current public page of the clinic on a computer and phone. We do not publish threat code, private visitor records and administrative access data.
How we verified the result
Based on the results of the recovery stage, the main page, access to the admin panel, core files and the database were checked. The re-scan is specific to the detected threats and the selected area of work.
In the published material about signs of hacking, it is separately stated: calls from bots and even HTTP 200 do not prove the execution of the command. Requests are matched against file contents and other server events.
During the preparation of this case, a public website was opened for screenshots. No new enquiries were sent to the clinic website.
Scope of the result
Cleaning detected code and successful scans do not prove the absence of any hidden threat. Fully establishing the reasons for the intrusion requires a separate study of logs, accesses and change history.
The current page image illustrates the interface. It does not provide evidence of server security or continued functionality following the August restore.
What to consider for a similar project
When restoring WordPress, it's worth taking cleaning, updating, and protecting files as separate tasks. The report should list the areas checked and the remaining issues so that the owner understands the boundaries of the result.