Site under attack right now? +91 92429 45793

■ Incident Response · Fixed-Fee Emergency Packages

Sucuri sells scans. We sell the engineers who actually removed the malware and wrote the breach notice.

Case #2024-04 · AnonymisedRESOLVED

Vector: Magecart-style skimmer on Checkout

Detected: Day 14

Removed: Day 14

Notified CNIL: Day 16 (within 72-hour window)

Outcome: No card data confirmed exfiltrated post-removal

Ritesh Agarwal, lead architect at Appycodes

■ Incident response — talk to the lead architect

Active incident, suspected compromise, or post-cleanup hardening needed? Bring it directly to Ritesh — no SDR, no qualification call.

Ritesh Agarwal · Lead Architect, Appycodes · LinkedIn

Brief Ritesh on the incident Or call +91 92429 45793

■ What you get

Six engagements covering the full incident lifecycle.

We don't sell a scanner. We sell engineers who treat the compromise like the start of a project, not the end of one.

Emergency malware removal

Magecart skimmers, SEO-spam injections, redirect malware, cryptominers, backdoor PHP shells. Identified, removed, root cause documented.

Forensic incident response

Timeline reconstruction. Breach-window estimation from page revision history. Indicator-of-compromise documentation handed to your legal and DPO.

Post-cleanup hardening

File integrity monitoring, WAF rules, geo-blocking, ASN blocking, full credential rotation (DB, API keys, hosting panel, FTP/SSH, gateways), 2FA enforcement.

Breach-notification support

GDPR Article 33, CNIL, ICO. What to write, when to write it, what counts as a notifiable breach, who has to be told within 72 hours.

Ongoing security retainer

Monitoring, alerting, patch management, scheduled scans. Quarterly review. Not a vendor relationship — a phone number that picks up at 02:00.

Legacy PHP upgrades

7.x → 8.x. The work that should have happened before the compromise — done after, with the codebase rewritten where the old packages stopped receiving security patches.

▼ The IOC Map

What a clean site doesn't have.

Twelve indicator-of-compromise patterns we look for during an incident. Each tile is the one-line check we actually run.

File mtime drift

find wp-content -mtime -30 -type f

PHP in /uploads/

find wp-content/uploads -name '*.php'

eval(base64_decode(

grep -R 'eval(base64_decode' wp-content/

option_value injection

SELECT option_value WHERE LIKE '%<script%'

Admin user drift

wp user list --role=administrator

Cron task hijack

wp cron event list

.htaccess rewrite

git diff .htaccess (or backup compare)

Skimmer JS in content

grep -R 'metrics.js\|easystation' wp_posts

Backdoor polling URLs

tail -f access.log | grep wp-load

ASN traffic spikes

Cloudflare Firewall Events · group by ASN

WSO / FilesMan shells

grep -R 'FilesMan\|WSO\|assert(\$_'

Iframe injections

grep -R '<iframe[^>]*src="http' theme/

■ Evidence — anonymised case files

Two incidents. Two distinct attack patterns. Both closed cleanly.

CASE-2024-FIBREBIO-01Magecart skimmer on Checkout

French WooCommerce site running Payplug + WPML. Duplicate card-detail fields appeared at checkout. Initial hypotheses (duplicate plugins, WCML gateway double-registration, Gutenberg block conflicts, theme overrides) all ruled out methodically.

Actual cause: malicious third-party script easystation.top/fibrebio/metrics.js injected into Checkout page content, rendering a fake payment form overlay alongside the legitimate Payplug form. Classic Magecart pattern — overlay captures, exfiltrates, passes through to the real form so the order completes and nobody notices.

Post-removal: file-mtime audit across wp-content/ for 30 days, grep for backdoor patterns (eval(base64_decode, eval(gzinflate, assert($_, FilesMan, WSO), PHP-in-uploads scan, SQL audit of wp_options for script injection, admin user review, MalCare deep scan with second-pass confirmation, full credential rotation, GDPR Article 33 conversation with the client.

CASE-2024-PLUSHEAT-01DDoS + suspected backdoor on EOL PHP 7.4

nginx upstream timeout cascade caused by PHP-FPM worker pool exhaustion. Diagnosed: coordinated bot attack from Hetzner Cloud IPs hitting /boiler-cover/ variants. Higher-priority finding alongside: POST requests to wp-load.php and /v1/wp-load.php with randomised hex query parameters — backdoor polling pattern suggesting the install was already compromised.

Remediation: ASN-level Cloudflare blocking, aggressive page caching to absorb bot traffic, reduced fastcgi_read_timeout, geo-blocking by country allowlist with cf.client.bot bypass for verified Googlebot. Deployed first under Managed Challenge before switching to Block to avoid taking down legitimate traffic.

Hardening engagements run alongside maintenance & support, custom WordPress, and WooCommerce development. Edge-layer work for WAF and geo-blocking ties into Cloudflare edge engineering.

■ Good fit if

WooCommerce stores under active attack or post-compromise
WordPress sites with unexplained traffic spikes, blocked emails, or Google Safe Browsing warnings
Operators who need GDPR Article 33 support and don't know what's notifiable
Sites running EOL PHP, EOL plugins, or unpatched cores past 12 months

■ Probably not a fit

Spec-only hardening with no incident or compromise — start with a Sucuri or Wordfence scan
Static brochure sites with no checkout, no users, no PII
Anyone looking for a $50 'clean my site' freelancer

■ Tools we use

Boring, deliberate, repeatable.

Forensics

file mtime audit · grep for eval/gzinflate/WSO/FilesMan · MalCare deep scan

Edge

Cloudflare WAF · Managed Challenge → Block · ASN + geo allowlists · cf.client.bot bypass

Server

nginx logs · PHP-FPM worker pool tuning · fastcgi_read_timeout · 2FA on hosting panel

Compliance

GDPR Art. 33 · CNIL / ICO breach notification · IOC documentation for legal

■ Active incident

Call. We answer.

Engineers, not a ticketing queue.

+91 92429 45793

■ Other services

We build a lot more than this.

Explore the rest of what we build.

SaaS Web App Development

MVP to production builds, multi-tenant, billing, AI features.

Sucuri sells scans. We sell the engineers who actually removed the malware and wrote the breach notice.

Active incident, suspected compromise, or post-cleanup hardening needed? Bring it directly to Ritesh — no SDR, no qualification call.

Six engagements covering the full incident lifecycle.

Emergency malware removal

Forensic incident response

Post-cleanup hardening

Breach-notification support

Ongoing security retainer

Legacy PHP upgrades

What a clean site doesn't have.

Two incidents. Two distinct attack patterns. Both closed cleanly.

Boring, deliberate, repeatable.

Call. We answer.

We build a lot more than this.

SaaS Web App Development

React Native App Development

Web App to Native Mobile App

Technical SEO for SaaS

Custom WordPress Development

Shopify Development Services

Custom WooCommerce Development

Maintenance & Support

AI App Completion

AI Prototype to Native App

App Store Launch

Tech Stack Migration

White Label Development

Startup Launch Support

API & Integration

AI SaaS Product Development

B2B Marketplace Development

Custom LMS Development

Membership & WooCommerce Subscriptions

Shopify Migration

Laravel Development & Modernisation

Stripe Billing Engineering

Cloudflare Edge Engineering

Internal Tools & Admin Dashboards

Supabase Development

Headless WordPress & WooCommerce

Sanity CMS Development

Vue.js & Nuxt Development

WordPress Performance Optimisation

Custom WordPress Plugin Development

Knowledge Base & Community Platforms

Event Ticketing Platforms

AI Chatbot, RAG & Agent

Workflow Automation

Programmatic SEO Engineering