[{"data":1,"prerenderedAt":251},["ShallowReactive",2],{"route:\u002Fportfolio-item\u002Finmykorea":3},{"kind":4,"doc":5,"prev":243,"next":247},"work",{"id":6,"title":7,"body":8,"categories":220,"date":224,"description":225,"extension":226,"featured":227,"image":89,"meta":228,"navigation":227,"path":229,"seo":230,"specs":231,"stem":240,"tag":241,"website":35,"__hash__":242},"portfolio\u002Fportfolio-item\u002Finmykorea.md","InMyKorea",{"type":9,"value":10,"toc":212},"minimark",[11,85,116,185],[12,13,16,25,30,39,42,82],"page-section",{":narrow":14,"align":15},"true","left",[17,18,21],"div",{"className":19},[20],"eyebrow",[22,23,24],"p",{},"Case study · WordPress rescue",[26,27,29],"h2",{"id":28},"the-challenge","The challenge",[22,31,32,38],{},[33,34,7],"a",{"href":35,"rel":36},"https:\u002F\u002Finmykorea.com\u002F",[37],"nofollow"," is an independent South Korea travel guide written by Joel, a British expat who has lived in Korea since 2015. In October 2026 the WordPress site was badly compromised by an SEO-spam and backdoor kit.",[22,40,41],{},"What we found on the server:",[43,44,45,53,64,70,76],"ul",{},[46,47,48,52],"li",{},[49,50,51],"strong",{},"19 PHP backdoors disguised as images, fonts and CSS files",", loaded from injected lines in WordPress core",[46,54,55,63],{},[49,56,57,58,62],{},"1,716 planted ",[59,60,61],"code",{},".htaccess"," files"," that locked out security plugins and other cleaners",[46,65,66,69],{},[49,67,68],{},"A cloaking page"," that showed Google spam while visitors saw the normal site",[46,71,72,75],{},[49,73,74],{},"A fake sitemap with 1,922 spam URLs"," submitted in the site's name",[46,77,78,81],{},[49,79,80],{},"A script added to the theme footer"," that loaded an outside payload for visitors",[22,83,84],{},"The first change dated back two months, so there was no clean backup to restore from. Every file had to be proven clean before it could be trusted.",[86,87,90,94,100,106],"split",{"alt":88,"image":89},"InMyKorea homepage after the rebuild","\u002Fimages\u002F2026\u002F11\u002Finmykorea-home.jpg",[26,91,93],{"id":92},"the-approach","The approach",[22,95,96,99],{},[49,97,98],{},"Check everything, trust nothing."," We wrote a malware scanner that checks code, uploads, the database and the final static files in four separate gates. Plugins and the theme were downloaded fresh from wordpress.org and checksum-verified, never copied from the infected site.",[22,101,102,105],{},[49,103,104],{},"Take WordPress off the internet."," WordPress now runs in Docker on a local machine with no internet access. Joel keeps writing in the editor he knows. The public site is a static export on Cloudflare Pages, with no PHP, no database and no login page for an attacker to find.",[22,107,108,111,112,115],{},[49,109,110],{},"Keep everything that worked."," Old Rank Math redirects moved into a Cloudflare ",[59,113,114],{},"_redirects"," file, site search runs in the browser with Pagefind, and tracked short links run in one small Pages Function. Every deploy writes a SHA-256 manifest of every file, so any unexpected change shows up.",[12,117,119,123,182],{":narrow":14,"align":15,"tone":118},"grey",[26,120,122],{"id":121},"the-result","The result",[124,125,126,138],"table",{},[127,128,129],"thead",{},[130,131,132,135],"tr",{},[133,134],"th",{},[133,136,137],{},"November 2026",[139,140,141,150,158,166,174],"tbody",{},[130,142,143,147],{},[144,145,146],"td",{},"Published articles",[144,148,149],{},"94 posts, 15 pages",[130,151,152,155],{},[144,153,154],{},"Hosting",[144,156,157],{},"Static files on Cloudflare Pages; WordPress offline",[130,159,160,163],{},[144,161,162],{},"Google search (28 days to 6 Nov)",[144,164,165],{},"168,251 impressions, 985 clicks, average position 8.7",[130,167,168,171],{},[144,169,170],{},"Files deployed",[144,172,173],{},"About 10,500, down from about 31,800",[130,175,176,179],{},[144,177,178],{},"Deploys since the rebuild",[144,180,181],{},"63, each with a file manifest",[22,183,184],{},"The rebuilt site also gained things the old one never had: interactive trip-planning tools, weekly Search Console reports that score every content change, and Instagram carousels and narrated Reels generated from each article.",[86,186,189,193,196],{"alt":187,"image":188,":reverse":14},"InMyKorea transport cost calculator","\u002Fimages\u002F2026\u002F11\u002Finmykorea-transport-calculator.jpg",[26,190,192],{"id":191},"whats-next","What's next",[22,194,195],{},"We're testing \"Ask the Guide\", an answer box that replies to reader questions using only InMyKorea's own articles and links to the sections it used.",[22,197,198,201,202,206,207,211],{},[49,199,200],{},"Has your WordPress site been hacked, or are you worried it will be?"," See ",[33,203,205],{"href":204},"\u002Fservices\u002Fwordpress-rescue\u002F","WordPress rescue"," or read the ",[33,208,210],{"href":209},"\u002F2024\u002F06\u002F10\u002Fwelcome-to-inmykorea-com-your-ultimate-guide-to-discovering-korea\u002F","full build write-up",".",{"title":213,"searchDepth":214,"depth":214,"links":215},"",2,[216,217,218,219],{"id":28,"depth":214,"text":29},{"id":92,"depth":214,"text":93},{"id":121,"depth":214,"text":122},{"id":191,"depth":214,"text":192},[221,222,223],"Security","Website","SEO","2026-10-12","A hacked WordPress travel blog, cleaned up and rebuilt as a static site on Cloudflare. WordPress now runs offline as the editor, so there is nothing left on the public internet to break into.","md",true,{},"\u002Fportfolio-item\u002Finmykorea",{"title":7,"description":225},[232,235,238],{"label":233,"value":234},"Before","WordPress, infected",{"label":236,"value":237},"After","Static, Cloudflare Pages",{"label":239,"value":149},"Articles","portfolio-item\u002Finmykorea","Rescue","ZBGlY78yaK4XF4jutCEuMN0bWXM54I7aGcueeyPjLjU",{"title":244,"path":245,"stem":246,"children":-1},"Aussie Outrage","\u002Fportfolio-item\u002Faussie-outrage","portfolio-item\u002Faussie-outrage",{"title":248,"path":249,"stem":250,"children":-1},"Project Powder","\u002Fportfolio-item\u002Fproject-powder","portfolio-item\u002Fproject-powder",1794316677891]