Portfolio and Projects

• Client: World Travel Bookings
• Agency: Jaydee Media (Jeanette du Toit)
• Platform: WordPress | Kadence Theme | Elementor
• Threat Level: Critical (Malicious Redirects & SEO Blacklisting)

1. THE CHALLENGE: The Zombie Infection

The client reported that worldtravelbookings.com was redirecting visitors to a Russian adult site. This wasn’t just a simple hack; it was a persistent “Zombie” infection.

• Initial Attempt: A full server wipe and restore from a 2022 backup.

• The Result: Failure. Within hours, the Russian script “re-spawned,” proving that the malware was hiding in the database or using a backdoor script to call home and re-infect the clean files.

2. THE DIAGNOSIS: How the “Shortcut” Failed

Through a 5-hour deep-dive audit, Jaydee Media identified three “ghost” entry points that allowed the hack to survive a server wipe:

1. The Uploads Trojan: PHP files (disguised as images) were hidden in wp-content/uploads. Even when the theme was cleaned, these files remained.

2. The Database Payload: Malicious code was injected into the wp_options table, specifically targeting the siteurl and home rows.

3. The Cron Job Backdoor: A scheduled task was set up at the server level (Hostinger) to automatically re-download the malware if it was deleted.

3. THE SOLUTION: The “Nuclear” Cleanup Protocol

Jaydee Media moved away from “patching” and implemented a Total System Reset:

• File System Sterilization: Deleted all files in public_html except the wp-config.php and uploads folder. Replaced the entire WordPress core with fresh files from WordPress.org.

• Theme & Plugin Purge: Completely deleted the Kadence theme and Elementor plugin folders, replacing them with verified, official versions.

• The PHP Hunt: Manually scanned the uploads directory and deleted all unauthorized .php files (e.g., gate.php, index.php) that should never exist in an image folder.

• Database Hardening: Ran a specialized “Search & Replace” on the SQL database to strip out the Russian redirect URLs and reset the database password to break the hacker’s connection.

• Server Lockdown: Cleared all unauthorized Cron Jobs in the Hostinger hPanel and updated the salts in wp-config.php to force-logout all active sessions.

4. THE RESULT: 2026 Security Standards

• Uptime: 100% stable following the deep clean.

• SEO Recovery: Removed from Google’s “Deceptive Site” blacklist.

• Protection: Implementation of a “Zero-Trust” update policy—no nulled software, only official licenses.

THE JAYDEE MEDIA TAKEAWAY

“There is no free lunch.” This case study proves that restoring an old backup isn’t enough if the hacker has a backdoor. Real security requires a Surgical Swap of the files and a Nuclear Scrub of the database.