Case study · Malware removal
Natalia Wuest Art Shop
An artist's online shop, cleaned of malware and reopened after a suspension
Malware cleanup for an artist's WooCommerce art shop: backdoors, spam and rogue admins removed, the shop back online and hardened.
- Client
- Natalia Wuest Art Shop
- Service
- Malware removal & recovery
- Industry
- E-Commerce
- Timeline
- Apr 1 – 3, 2026
- Role
- Cybersecurity Specialist · Web Developer · WordPress Developer
Overview
Natalia Wuest sells original paintings and reproductions through her own WordPress and WooCommerce shop, shipping to art lovers worldwide. The site had been hacked. Visitors were being redirected to spam, browsers were showing a security warning, and the hosting provider had suspended the account, taking the shop offline. For an online shop, every day offline is a day without sales, so I was brought in to remove the infection and get the shop back online securely.
What was done
- Removal of malicious redirects and spam content
- Cleanup of injected code in infected files
- Removal of hidden backdoor files
- Removal of admin accounts the owner never created
- Security hardening after the cleanup
- The shop restored and back online, with its catalogue intact
Tech review
The shop runs on WordPress with WooCommerce and Elementor. I handled the full recovery, working in the hosting account, the site's files and the WordPress database.
Key highlights
- 01
Orders and products left intact
An online shop is more than its pages: it holds the product catalogue, orders and customer accounts. The cleanup removed the malicious code while keeping the shop itself intact, so the artworks were ready to sell again as soon as the site came back.
- 02
Backdoors and fake admins removed too
The spam and redirects were the visible problem. Underneath were injected code in infected files, hidden backdoor files that would have let the attackers back in, and admin accounts the owner never created. All of it was removed, because cleaning only what visitors can see leaves the door open.
- 03
Locked down after the cleanup
After the cleanup, I secured the site with:
- a security plugin with firewall and login protection
- WordPress core, plugins and themes brought up to date
- all passwords reset
- unused plugins and themes removed
- 04
Back in business
With the infection gone, the hosting account is active again and the shop is back online for collectors.
The result
The shop is open again, with the malware removed and the way in closed.