WordPress/WooCommerce Security Expert Needed – Recurring Malware & Backdoor Investigation

# WordPress / WooCommerce Malware Investigation and Removal We are looking for an experienced WordPress security specialist to investigate and fully remediate a recurring malware infection on a WooCommerce website. Our internal development team has already carried out several malware cleanups. Malicious files are removed, but further malicious files are appearing again, typically within approximately 24 hours. We therefore need someone with strong WordPress security and malware investigation experience who can identify the **root cause and persistence mechanism**, rather than simply carrying out another file cleanup. ## Scope of Work The successful freelancer will be expected to: * Carry out a full security review of the WordPress/WooCommerce installation. * Identify all malicious files, injected code, backdoors and persistence mechanisms. * Determine how the website is being reinfected. * Review WordPress core files, plugins and themes for unauthorised modifications. * Check the database for malicious injections, rogue administrators, scheduled tasks or other suspicious entries. * Review WordPress cron jobs and server-level cron jobs where relevant. * Check for compromised administrator, FTP/SFTP, hosting or database credentials where evidence indicates this may be an issue. * Review relevant server and access logs to identify the likely attack vector where possible. * Remove all malicious code and compromised files. * Replace compromised WordPress core/plugin/theme files with clean versions where appropriate. * Identify vulnerable, abandoned or compromised plugins/themes. * Apply appropriate security hardening after the cleanup. * Confirm that no obvious persistence mechanisms remain. * Provide recommendations to reduce the risk of reinfection. ## Important This is **not simply a request to run a malware scanner and delete flagged files**. Our team has already performed repeated cleanups. We need someone who is experienced in investigating persistent WordPress infections and can establish why the malware keeps returning. The website is an active WooCommerce installation, so work must be carried out carefully to avoid unnecessary disruption to the live website or loss of legitimate website/order data. ## Deliverables At completion, we require: 1. Website cleaned of identified malware and backdoors. 2. Root cause or most likely source of reinfection identified. 3. Persistence mechanisms removed. 4. Security vulnerabilities found during the investigation addressed or clearly documented. 5. A short written report covering: * What was found. * How the infection was persisting. * What was removed or changed. * Any remaining risks. * Recommended preventative measures. ## Required Experience Please apply only if you have demonstrable experience with: * WordPress malware investigation and removal. * Persistent/reoccurring WordPress infections. * WooCommerce websites. * PHP malware and obfuscated code. * WordPress database compromise. * Backdoors, web shells and malicious cron jobs. * Server/access log analysis. * WordPress security hardening. Experience working with compromised production WooCommerce websites is particularly important. ## When Applying Please briefly explain: * Your experience with recurring WordPress malware infections. * How you would approach identifying the reinfection mechanism. * Examples of persistence methods you have encountered on compromised WordPress sites. * Whether you can provide a short remediation report after completing the work. We are looking for someone who can investigate this thoroughly and provide confidence that the underlying compromise has been addressed, rather than carrying out another temporary cleanup.