| Client | Hartwell Outdoors (fictional example store) |
| Site | hartwell-outdoors.example — WooCommerce, ~1,400 orders/month |
| Engagement window | July 14–16 (cleanup) + 30-day monitoring window ending August 15 |
| Status at delivery | CLEAN — verified, hardened, monitored |
| Prepared by | [freelancer name] — WooCommerce break-fix & security |
Your store was infected with a credit-card skimmer: a small piece of malicious JavaScript injected into the checkout page that copied card details as customers typed them and sent them to an attacker-controlled server. It entered through an outdated form plugin with a publicly known vulnerability (plugin name withheld in this sample report).
The skimmer, two PHP backdoors, and one rogue administrator account were removed. The entry point is patched, the site is hardened against the same class of attack, and every administrator credential has been rotated. The store was never taken offline during cleanup, and checkout now passes an end-to-end test purchase cleanly.
Recommended next step for you as the owner: notify your payment processor of the incident window (July 2–14) so they can monitor affected cards. A ready-to-send summary for them is included at the end of this report.
| July 2 (est.) | First compromise — vulnerable plugin exploited; backdoor wp-content/uploads/.cache.php written. |
| July 5 (est.) | Skimmer script injected into the checkout page via the theme's footer template. |
| July 14, 09:20 | Engagement start. Full site + database backup taken before any change. |
| July 14, 13:45 | Skimmer identified and removed; malicious outbound domain blocked. |
| July 15 | Two PHP backdoors and one rogue admin account removed; entry-vector plugin updated; all credentials rotated. |
| July 16 | Hardening applied; end-to-end test purchase verified clean; monitoring window started. |
Obfuscated script appended to the theme footer, active only on /checkout/. It exfiltrated card number, expiry, CVC and billing name on form submit to an external domain. Removed; the outbound domain is blocked at the firewall level.
wp-content/uploads/.cache.php and a modified copy of a legitimate plugin file. Both allowed the attacker to re-enter even after a password change. Removed; file integrity now monitored.
An admin user created on July 3 with a look-alike name. Deleted; all remaining accounts verified against the owner's list and re-credentialed.
A form plugin, last updated in 2023, with a publicly documented vulnerability that allows unauthenticated file upload. The vulnerable version was live on the site at the estimated first-compromise date. The plugin has been updated to the current patched release; the uploads directory no longer executes PHP (see hardening).
wp-content/uploads/.DISALLOW_FILE_EDIT).This cleanup carries a 30-day anti-reinfection guarantee: if the same infection returns within 30 days of delivery, it is removed again at no cost. The monitoring window includes file-integrity alerts reviewed daily and a follow-up integrity check at day 30.
Note on this sample: every detail above — the store, dates, file paths and findings — is fictional, assembled to show the structure, depth and plain-language standard of the report a real cleanup client receives. Real reports additionally include the exact indicators of compromise and the processor-notification summary.