WA Cafe: WordPress Security Audit & Malware Cleanup

Project overview

123 suspicious files hidden inside WordPress core directories. That was the unexpected discovery during what should have been a routine PHP security update for WA Cafe, a London-based Japanese cafe running its online ordering system through WordPress and WooCommerce.

The original task was straightforward: update PHP to address urgent security concerns and make sure the website continued working. But a wider security audit revealed a more serious problem. Alongside the suspicious files, the site contained vulnerable plugins, an outdated page builder and several extensions that had been removed from the official WordPress directory.

For a business accepting online orders and handling customer information, these were risks that could not be ignored.

I approached the project in two stages: first securing the PHP environment and updating WordPress, then carrying out a more comprehensive WordPress security cleanup and remediation. The work included removing suspicious files, restoring clean core files, reviewing outdated components and strengthening the website’s protection.

The goal was simple: make the existing website safer without disrupting the cafe’s online ordering system or forcing an expensive rebuild.

The project combined WordPress support and maintenance, security auditing and WooCommerce compatibility testing.

The challenge

WA Cafe’s website was operational, but its underlying technology had accumulated years of technical debt. Several plugins were outdated, some were no longer officially maintained and the PHP environment needed urgent attention.

The real challenge was not simply updating software. It was understanding how far the security problems extended while protecting the functionality the business depended on every day.

A PHP upgrade could address vulnerabilities in the server environment, but it would not automatically remove suspicious files or resolve weaknesses in third-party plugins.

The priority was to address the immediate risks, investigate the wider installation and avoid unnecessary disruption to the existing website.

What was delivered

The work began with the urgent PHP update. Before changing the server environment, I backed up the website files and database to establish a recovery point.

After completing the update, I tested the existing website and updated WordPress itself. I also carried out a security audit at no additional cost, which uncovered the more extensive problems described above.

Following the findings, WA Cafe approved a second phase focused on removing suspicious files and addressing the remaining security weaknesses.

What the audit revealed

The investigation highlighted a common problem with older WordPress installations: individual components may continue working for years even when their security and maintenance status has changed significantly.

Three findings stood out.

The important lesson was that the website’s visible functionality gave little indication of the condition of the software underneath it.

Key technical decisions

The guiding principle was repair and secure the existing installation before considering a replacement.

WA Cafe already had an operational WooCommerce website. Rebuilding it would have introduced additional cost, migration complexity and disruption without necessarily being required to solve the immediate security problems.

Instead, the remediation followed a controlled sequence: preserve a backup, address the server environment, inspect the installation, restore trusted files, review third-party dependencies and validate the finished website.

Why upgrading PHP alone was not enough

WordPress security depends on several separate layers: the PHP runtime, WordPress core, themes, plugins, user access and server configuration.

Updating one layer does not automatically secure the others.

In this project, the PHP update addressed the original maintenance concern, but the wider audit revealed additional issues that would otherwise have remained unresolved.

That discovery changed the scope from routine maintenance to a more comprehensive security remediation.

Results and outcomes

The project concluded with the initial PHP security update completed and the additional remediation work delivered.

The most significant result was the removal of 123 suspicious files from WordPress core directories, alongside clean-file restoration, vulnerable plugin remediation and strengthened security settings.

The existing WordPress and WooCommerce installation was retained, avoiding the need for an immediate rebuild.

The outcome was a cleaner, more maintainable WordPress installation with fewer identified security risks and a stronger foundation for ongoing maintenance.

No security cleanup can guarantee that future attacks will never occur. Regular updates, backups, access reviews and periodic audits remain essential, particularly for websites processing online orders.

Technology used

The existing website runs on WordPress, WooCommerce and PHP, using theme-related plugins and a visual page builder to support its content and online ordering functionality.

The project involved PHP maintenance, WordPress core updates, clean-file restoration, website file and database inspections, third-party plugin remediation and security hardening.

Components reviewed during the audit included Bridge Core, Slider Revolution, WPBakery Page Builder and several legacy WooCommerce extensions.

The work focused on improving the security of the existing technology stack rather than introducing a new framework or rebuilding functionality that was already working.

Next steps

With the immediate security concerns addressed, the next priority for WA Cafe is ongoing maintenance.

Regular PHP and WordPress updates, plugin reviews, backups and security monitoring will help prevent the same problems from accumulating again.

A separate proposal was also prepared for a future website rebuild using Next.js, with a simplified editing dashboard, seasonal campaign management, enquiry forms and optional customer management functionality. That remains a potential future project rather than part of the completed security work.

The key takeaway from this project is simple: a website can appear to work perfectly while serious security problems exist underneath.

For businesses relying on WordPress or WooCommerce, a proactive security audit can uncover problems before they develop into a larger incident.

If your website has outdated plugins, suspicious files or an unsupported PHP environment, professional WordPress support and maintenance can help identify the risks, prioritise the fixes and protect the functionality your business depends on.