Responding to a Website Security Breach

The Purple Bytes is a digital marketing and software studio based in Lalitpur, serving clients across Australia, the UK, the US, Canada, and the UAE. Like many agencies, we rely on our own website as a primary point of contact — it represents our work, our values, and our credibility to prospective clients.

In June 2026, our website became the target of an automated SQL injection attack. The attackers injected foreign spam content — French-language casino and news-block text — directly into our database and onto our homepage. This is a documented attack pattern used to exploit websites for search engine spam.

Incident Timeline

What Happened

A vulnerability in a third-party WordPress plugin allowed attackers to inject malicious content directly into the site’s database. The injected content appeared as foreign-language spam — French casino keywords and news-block text wrapped in HTML tags — visible on the homepage and stored in the database.

Critically, the Wordfence security plugin, which would normally detect and alert on such activity, had been disabled as part of the attack — a deliberate move to suppress detection. This delayed automatic alerting but did not prevent our team from spotting the compromise immediately upon logging in.

No client data, credentials, or sensitive business information was accessed or exfiltrated. The damage was limited entirely to injected content on the website itself.

Our Response

Immediate Containment (Day 1 — June 15)

• Changed Hostinger hosting account password and WordPress admin password immediately
• Audited all WordPress user accounts and removed any unrecognised or unnecessary users
• Re-enabled Wordfence security plugin and ran a full site scan
• Removed all third-party plugins flagged by Wordfence as security vulnerabilities
• Manually reviewed every page on the site for injected content
• Inspected the database directly via phpMyAdmin to locate and remove all injected entries

Full Hardening (Day 2 — June 16)

• Enabled two-factor authentication (2FA) for every WordPress user account
• Rebuilt one page that had been significantly altered by the injection
• Applied targeted fixes to the homepage where spam content had appeared
• Ran multiple additional Wordfence scans to confirm a clean state
• Conducted a thorough second pass of the database to ensure no residual injected content remained

Outcome

Within 48 hours of detection, the site was fully cleaned, hardened, and back to normal operation. The vulnerable plugins were removed entirely. Two-factor authentication is now enforced across all accounts, and Wordfence remains active with monitoring enabled.

More importantly, no client data was exposed at any point. The attack was opportunistic and automated — targeting a plugin vulnerability rather than our business specifically. Our response was swift, methodical, and thorough.

What We Learned

This incident reinforced several security principles we now apply rigorously for both our own site and client projects:

• Security plugins must be monitored — not just installed. An inactive Wordfence was a key factor in the attack going undetected over the weekend.
• Plugin hygiene matters. Third-party plugins are the most common WordPress attack vector. We now audit plugins regularly and remove anything that is unused or flagged.
• Two-factor authentication is non-negotiable. All user accounts now require 2FA — a simple step that significantly raises the barrier for unauthorised access.
• Routine database checks should be part of any site maintenance workflow. Injected content in the database is easy to miss without a deliberate inspection process.

Why This Matters to Our Clients

We share this case study not to highlight a failure, but to demonstrate how we operate when things go wrong. Security incidents are a reality for any business with an online presence — what matters is how quickly and competently you respond.

At The Purple Bytes, we handled this entirely in-house, without downtime to client projects, and with full transparency. The same rigour we applied to our own site is what we bring to every website we build and maintain for clients.

If you are concerned about the security posture of your WordPress site or any other web property, we are happy to discuss how we can help.