By Zhe, The SEO Queen · The SEO Queen Blog
Disclaimer: No credit card data was exposed or compromised during this time.
I want to tell you something that most people in my position would never admit publicly.
My website got hacked. Not just my website. My entire hosting account. And the attacker was sitting quietly inside my server for three months before I found out.
Three months of access. Three months of stolen data. Three months of a criminal operating out of my digital house without paying a single dollar in rent.
I am The SEO Queen. I have been doing this since 2017. I have helped businesses generate over $250 million in revenue through search. I teach digital strategy. And it still happened to me.
So if you think it cannot happen to you, keep reading.
Most people hear the word “virus” and picture something that slows your computer down or pops up annoying ads. A Remote Access Trojan — or RAT — is a completely different animal.
A RAT is a piece of malicious software that gives an attacker full remote control of your system without your knowledge. Not partial access. Full control. The same kind of access you have when you log into your own website — but they have it too, silently, running in the background every single time your site loads. This insidious hack slows down your website and hinders your visibility online every time your website loads slower.
Here is what the RAT on my hosting account was doing while I was running my business:
Phoning home to attacker-controlled servers. Every time a page loaded on my website, the RAT sent an encrypted signal to the attacker’s command center reporting on my site’s status and receiving new instructions. My website was essentially sending a check-in call to a criminal every few minutes without my knowledge.
Creating hidden administrator accounts. The RAT generated fake WordPress admin accounts with randomly generated usernames designed to blend in. These accounts could not be seen in the normal WordPress admin user list because the RAT filtered them out of the display. They were invisible to me but fully operational for the attacker.
Generating valid WordPress login cookies. This means the attacker could walk straight into my WordPress dashboard without ever touching the login page. No username. No password prompt. Just instant access.
Accessing customer order data. The RAT targeted WooCommerce order records stored in my database — information like customer names, email addresses, and billing addresses. Because my store uses a payment gateway that tokenizes card data, no credit card numbers were ever stored on my server or accessible to the attacker.
Spreading itself into other plugin files. The RAT did not just sit in one place. It injected copies of its own code into legitimate plugin files across my installation. Every time I might have deleted one copy, other copies were already running in different locations. It was designed to survive.
Self-updating. The RAT could download a newer version of itself from the attacker’s server and overwrite the old version automatically. It was not static malware. It was a living, evolving threat.
Hiding from security scans. It removed itself from every admin-visible list and could even detect and delete security plugins that might flag it.
This is not a script kiddie running basic attacks. This is sophisticated, professional cybercrime. And it targets small business owners specifically because we are less likely to have enterprise-level security teams watching our servers around the clock.
The entry point was a plugin called boldgrid-backup-premium.
This plugin had a known vulnerability that allowed files to be written to the server without proper authentication. Meaning the attacker did not need my password. They exploited a hole in a plugin I had installed and used it as a doorway.
This is the most important sentence in this entire article: the plugin was installed, it was not updated, and it opened my entire server to an attacker.
The initial breach happened in April. The first thing the attacker did was quiet — just a few suspicious admin accounts created in the middle of the night across my sites. No alarms went off. No alerts fired. They were patient.
By June they were more aggressive. They planted the RAT in my must-use plugins folder — a special WordPress directory that runs automatically on every page load, does not show up in the regular Plugins list, and cannot be deactivated from the dashboard.
By July they had deployed a second payload directly into WordPress core files, giving themselves a remote code execution backdoor that could run arbitrary PHP on my server on demand.
Three months. Escalating access. Growing control.This is how hackers move. They implant admin accounts and escalate over time, testing to see if you notice.
And Wordfence — which I had installed — detected some of it but could not stop the RAT from reinstalling itself because the RAT was specifically designed to remove security plugins.
When I discovered the infection, I did not panic. I got methodical.
Step one was containment. I put the affected site into maintenance mode immediately so the public could not access it while I worked. This also cut off some of the attacker’s beacon cycles.
Step two was forensic investigation. I used file timestamps to determine exactly when each malware file was first created on my server. This gave me a timeline of the attack and helped me identify the entry point. The oldest malware file had a birth date that pointed directly to the vulnerable plugin.
Step three was credential rotation. Every password associated with the hosting account — cPanel, FTP, database, WordPress admin, secret keys and salts — all changed. This closed off any access the attacker might have had through stolen credentials.
Step four was automated cleanup. I built a custom bash script that scanned every PHP file across the entire server looking for the RAT’s specific code signatures. Not just filenames. Not just locations. The actual code patterns unique to this specific malware. The script quarantined every infected file and cleaned the legitimate files that had been modified.
Step five was lockdown. I deployed a security mu-plugin across every WordPress installation that blocked file editing from the dashboard, blocked plugin and theme installation without authorization, blocked new administrator account creation, and disabled xmlrpc — a legacy WordPress endpoint that serves almost no purpose for most sites but gives attackers a powerful attack surface.
Step six was hardening the .htaccess file. I rewrote the server configuration file to block PHP execution in the uploads directory, protect sensitive files from direct browser access, block common SQL injection patterns in URLs, restrict HTTP methods to only what WordPress actually needs, and prevent server version information from being exposed in response headers.
Step seven was monitoring. I set up automated cron jobs that run every hour scanning for the specific malware patterns, every day generating a full report of every admin account across every site, and sending real time email and SMS alerts if anything suspicious appears.
Step eight was database cleanup. The RAT had planted hidden records in the WordPress database to store the ID of its rogue admin account so it could reference and recreate it. Every database across the account needed those records removed.
I have been doing SEO and digital strategy for almost 20 years.I have built websites, written about them, taught workshops about them. But this experience pushed me into a level of security knowledge that I did not have before — and I want to pass it on to you.
Update your software. Not eventually. Now.
Every plugin, every theme, every version of WordPress sitting on your server is a potential door. When a vulnerability is discovered in a plugin, the developer releases a patch. If you do not install that patch, you are leaving a known door unlocked. Attackers scan thousands of sites per hour looking for exactly this. An outdated plugin is a welcome mat.
Delete plugins and themes you are not using.
Every inactive plugin or wordpress theme on your server is still a file that can be exploited. You do not even have to have it activated. If the files are there, the vulnerability is there. Go through your plugin list right now. If you have not used it in the last 90 days, delete it. Not deactivate. Delete.
Never install nulled or pirated plugins.
I want to be direct about this because I know the financial pressure small business owners face. Free cracked versions of premium plugins are almost always infected with malware before they are ever distributed. The person giving it away for free is not being generous. They are using you as a host for their attack infrastructure. Pay for the plugin or find a legitimate free alternative.
Your uploads folder should never contain PHP files.
WordPress stores images, PDFs, and documents in the uploads directory. It should never contain executable PHP files. One of the first things I check now on any site is whether someone has managed to drop a PHP shell into the uploads folder. If you find one, it is almost certainly malicious.
Shared hosting means shared risk.
When your site lives on a shared server with dozens or hundreds of other websites, a compromised neighbor can sometimes affect your site. This is not a reason to panic but it is a reason to consider whether your current hosting environment matches the security requirements of your business. If you are processing payments, handling customer data, or managing multiple sites, a managed WordPress host or VPS with isolated environments is worth the investment.
A security plugin is not a security strategy.
Wordfence is a good tool. I still use it. But a plugin that scans for known malware signatures cannot stop a RAT that is specifically designed to disable it. True security is layered — server-level hardening, file permission controls, monitoring, credential hygiene, and regular audits working together. No single plugin does all of that. You can learn more about how I approach website security for small businesses here.
I need to say something that does not get said enough in the tech world.
Small business owners — particularly Black owned and women owned businesses — are disproportionately targeted by cybercriminals. Not because we are careless. Because attackers know we are less likely to have a dedicated IT team. They know our margins are tighter. They know we are wearing ten hats and website security is not always at the top of the list.
That is not a character flaw. That is the reality of building a business without a safety net.
But that reality has to change. Your website is your storefront, your marketing department, your sales team, and your customer service desk all in one. If it is compromised, your revenue stops, your reputation takes a hit, and your customers’ data is at risk. If you are still building your digital foundation, start with how to SEO your business from scratch — because a secure, well-optimized site is the combination that actually moves the needle. And if you want to see what that looks like in practice, browse our SEO case studies to see real results from real small businesses.
Security is not a luxury add-on. For a small business operating in 2026, it is infrastructure.
You do not have to go through what I went through to get your website secured. That is exactly why I built this service.
Here is your immediate action list:
Start with a free SEO assessment to understand where your site stands from a visibility and health standpoint — security and SEO go hand in hand because a hacked site loses its rankings fast.
Log into your WordPress dashboard and check for plugin updates. Install every one that is waiting.
Check your user list under Users in your WordPress dashboard. Look for any accounts you do not recognize, especially ones with generic usernames or email addresses at free providers. Delete anything suspicious.
Check when your plugins were last updated. If any plugin has not been updated in over a year, research whether it is still actively maintained. If it is abandoned, find a replacement.
Make sure your WordPress version is current. Outdated WordPress core is one of the most exploited attack surfaces on the web.
If you have plugins installed that you are not actively using, delete them today.
What I went through this year was painful and time consuming. But it also gave me something valuable — a deep, firsthand understanding of exactly how these attacks work, how to detect them, how to remove them, and how to build defenses that hold.
I have packaged that knowledge and the tools I built into a Website Security Consultation service. In a Reach More Clients Power Session, we will walk through your specific site setup, identify your vulnerabilities before an attacker does, and build a hardening plan tailored to your business.
You do not need to wait until something goes wrong to get this right.
Book your Reach More Clients Power Session now and let us make sure your website is working for you — and not for someone else.
Zhe Scott is the founder of The SEO Queen and TSQ Marketing Inc., MIT-trained Strategic Business Architect, and author of SEO Training 2017: Search Engine Optimization and Marketing for Small Business. She has been helping small businesses get found online since 2016.
