Managed WordPress for a digital publisher
// problem
Legacy WordPress installation with 40+ plugins accumulated over years. Frequent uptime issues during traffic spikes, no proactive security monitoring, and a recurring pattern of malware injections through outdated plugins — JavaScript redirects, SEO spam in the database, and admin-user backdoors that kept reappearing after manual cleanups. Vulnerability patches were handled reactively (sometimes 2+ weeks after a CVE landed). One engineer was the load-bearing knowledge; everyone else was scared to touch it.
// what_we_did
Inventory of stack and plugins. Cleaned the existing infections, rotated all credentials, and audited admin users. Migrated to managed hosting with daily automated vulnerability scans (WPScan + OSV + NVD feeds matched against the live inventory). Hardened the stack — file-integrity monitoring, WAF rules, principle-of-least-privilege on the WP admin. Set up monitoring, alerting, and a written run-book. Plugin update pipeline with regression checks before pushing to production. Monthly written audit report.
// outcome
- 14d → <48hMean-time-to-patch reduction
- ~12 → 0Malware reinfections per year (was monthly)
- 0Security incidents in 12 months of operation
- ~30%Infrastructure cost reduction (hosting + tooling consolidation)