Law firm website security case study: a self-healing backdoor on a US injury firm's site

The client and the problem

The client is a US personal injury law firm, running a WordPress site. We also write the firm's monthly content under a written rulebook.

The site was found to be compromised. The malware sat in the must-use plugins folder, a part of WordPress that loads automatically on every page and does not appear in the normal plugin list. The file was named to look like a routine system component.

Why the usual fix did not work

Most WordPress infections can be handled from the admin panel: remove a plugin, update everything, run a scan. This one could not. It was self-healing. Deleting the visible file was not enough, because a reinfector put it back.

That is the point where many site owners assume the job is done when it is not. A site can look clean for an hour and be compromised again by the evening.

What we did

• Confirmed the infection and where it lived, in the must-use plugins folder rather than the normal plugins.
• Established that cleaning through WordPress admin would not hold, because the malware restored itself.
• Cleaned the site using a security plugin that works below the admin layer, installed for this purpose.
• Checked that the malware files were gone and that the reinfector had been neutralized.
• Set out the hardening steps that follow a cleanup.

The hardening list

Removing the malware is the first half of the job. The second half is making sure whoever got in cannot simply walk back in. After a cleanup like this, we recommend:

• Rotate every credential and the WordPress security salts, so stolen passwords and sessions stop working.
• Remove old copies of configuration files from the live server.
• Verify who has owner access in Google Search Console, so no unknown account can control how the site appears in search.

Law firm website security: warning signs worth checking

Firms often find out about a compromise late, from a client, a browser warning or a drop in search traffic. A few checks catch most problems earlier:

• Files in the must-use plugins folder that nobody on your side added.
• Admin users you do not recognize.
• Owners in Google Search Console you did not approve.
• Malware that comes back after it has been deleted, which points to a reinfector somewhere else on the server.
• Old copies of configuration files left on the live server.

How we ran it

One Signal Lead owned the incident from discovery to cleanup and kept a written record of what was found and what was done. For a law firm, that written trail matters as much as the fix: the firm can see exactly what happened to its site.

We treat security as part of looking after a site, not a separate emergency service.

What changed

The malware files are gone and the reinfector no longer brings them back. The firm has a clear, short list of hardening steps to close the door properly. We are not claiming more than the cleanup itself: hardening is what keeps a site clean afterwards.

Services used

Web Development, under website care and security, with SEO and GEO alongside for the firm's monthly content. If you suspect your firm's site has been compromised, book a 15-minute call and we will tell you what we would check first.

Book a 15-minute call.

A fit check, not a pitch. A few questions, an honest answer and a clear next step. Not every call ends in a proposal.

Book 15 minutes