Client's hacked site clean after 72-hour marathon

Celebration post, but also warning. Client on malý server at OVHcloud got full rootkit, injected into config after brute wp-admin. I spent 72 hours in forensic marathon. Found entry via plugin upload, pivot to user account, then on server as www-data. Cleaned manually, no restore from backup because backup was also compromised (hej, classic). Hardening applied: fail2ban tuned, wp file permissions locked, separate db user, removed xmlrpc, put wp-content outside web root. Client happy, paid invoice. No articles needed for good work.

Three weeks later same client emails: "into config again on new host". He reused same password from breach on Contabo account. No well.

I run twelve sites this way. Caddy handles automatic HTTPS, fail2ban in another container, and I snapshot the volumes before any update. The forensic marathon you describe is exactly what happens when you trust a provider to care about your security more than you do. Docker compose makes the whole stack reproducible. If a client of mine reused a password, I would rotate it automatically via my little ansible setup. Reverse proxy logs catch brute force before they reach the application. Just saying.

Na yes. This is why I run everything in gemütlich Cluster with External secrets Operator and automatic Certificate rotation. The human Factor is always weakest Link. So I do not let Clients choose their own Database passwords anymore. Random Generation or nothing. One Time I had similar Situation with KnownHost, Client insisted on memorable Passwort for his WordPress admin. Compromised within forty-eight Hours. So now my Policy is strict.

Your seventy-two Hour Marathon sounds exhausting. I hope you charged extra for the Incident response.

PetraSuper 72 hours is insane man, I tell all my clients this story so they stop reusing password that is basic stuff. I migrate everyone to Vultr (https://www.vultr.com), set password policy, and sleep finally

I try this on weekend, looks nice

Made VPS last month at RackNerd, now worried about security. PetraSuper, what tool you use for scan rootkit? I check with rkhunter but not sure is enough.

Client reused password is very bad, but happens often in my country too.

Separating wp-content from web root is excellent practice. I do similar setup in Singapore region with HostHatch, Asia-Pacific latency is good for my clients. Password reuse is common problem. I use Bitwarden for client credential sharing, though some resist. Your 72-hour effort deserves proper compensation.