RescueSecurity, Website, SEO
InMyKorea
A hacked WordPress travel blog, cleaned up and rebuilt as a static site on Cloudflare. WordPress now runs offline as the editor, so there is nothing left on the public internet to break into.
Case study · WordPress rescue
The challenge
InMyKorea is an independent South Korea travel guide written by Joel, a British expat who has lived in Korea since 2015. In October 2026 the WordPress site was badly compromised by an SEO-spam and backdoor kit.
What we found on the server:
- 19 PHP backdoors disguised as images, fonts and CSS files, loaded from injected lines in WordPress core
- 1,716 planted
.htaccessfiles that locked out security plugins and other cleaners - A cloaking page that showed Google spam while visitors saw the normal site
- A fake sitemap with 1,922 spam URLs submitted in the site's name
- A script added to the theme footer that loaded an outside payload for visitors
The first change dated back two months, so there was no clean backup to restore from. Every file had to be proven clean before it could be trusted.
The approach
Check everything, trust nothing. We wrote a malware scanner that checks code, uploads, the database and the final static files in four separate gates. Plugins and the theme were downloaded fresh from wordpress.org and checksum-verified, never copied from the infected site.
Take WordPress off the internet. WordPress now runs in Docker on a local machine with no internet access. Joel keeps writing in the editor he knows. The public site is a static export on Cloudflare Pages, with no PHP, no database and no login page for an attacker to find.
Keep everything that worked. Old Rank Math redirects moved into a Cloudflare _redirects file, site search runs in the browser with Pagefind, and tracked short links run in one small Pages Function. Every deploy writes a SHA-256 manifest of every file, so any unexpected change shows up.
The result
| November 2026 | |
|---|---|
| Published articles | 94 posts, 15 pages |
| Hosting | Static files on Cloudflare Pages; WordPress offline |
| Google search (28 days to 6 Nov) | 168,251 impressions, 985 clicks, average position 8.7 |
| Files deployed | About 10,500, down from about 31,800 |
| Deploys since the rebuild | 63, each with a file manifest |
The rebuilt site also gained things the old one never had: interactive trip-planning tools, weekly Search Console reports that score every content change, and Instagram carousels and narrated Reels generated from each article.
What's next
We're testing "Ask the Guide", an answer box that replies to reader questions using only InMyKorea's own articles and links to the sections it used.
Has your WordPress site been hacked, or are you worried it will be? See WordPress rescue or read the full build write-up.
