well, this is a little embarrassing.

I started this blog in 2013 to document bread baking and some home automation projects (RIP to my Raspberry Pi light controller, which I’m now realizing I should also go check on). Then, the way these things go, life happened and I completely forgot about it. Forgot I still had hosting. Forgot the login. Eventually forgot where it was even hosted at all.

Today I was trying to sort out an old ecobee thermostat login – the address was [email protected], which I always assumed forwarded through Google – and Google flatly told me the account doesn’t exist. That sent me down a DNS rabbit hole on this domain, which is how I discovered this blog had been quietly serving something considerably spicier than sourdough starter instructions for a while.

what I found

Somebody had turned my dusty little blog into a Spanish/German/Dutch online-casino spam farm. Of the 54,002 posts sitting in the database, 12 were mine. The other 53,990 had titles like “Wikibet Casino No Deposit Bonus 100 Free Spins” and “Automaty Točenie Zdarma 2026,” and most weren’t even posted through WordPress – they were inserted directly into the database, in batches, thousands of them sharing the exact same timestamp down to the second.

Digging further (with a lot of help, more on that below) turned up:

  • a file manager webshell hidden in the uploads folder, disguised with an innocuous filename, giving whoever planted it full read/write access to every site on my hosting account, not just this one
  • about 25 fake “plugins” with gibberish names, several of which were literal cloned copies of the real Akismet plugin, used as camouflage
  • a plugin called “Newsletter Pro” that, despite the friendly description, was actually malware – it scanned every PHP file on the site every 5 minutes hunting for other malware’s backdoors and fake admin accounts, and deleted them. malware, defending its turf from other malware
  • evidence of at least three separate break-ins, spread across October 2024, December 2025, and August 2026. this thing had been getting compromised repeatedly for almost two years and I never noticed, because I never looked

how I found (and fixed) it

I ran this whole investigation and cleanup with Claude Code, basically riding shotgun with me the entire way. I handed it a Cloudflare API token and a cPanel API token and let it work through the problem – it figured out my DNS was still pointed at an ancient Arvixe hosting account from a decade ago that I had completely forgotten existed, pulled apart the webshell it found to confirm exactly what it was, traced how the malware operated, and then, once I was actually home and could sit with it, we did the real cleanup one authorized step at a time. I made it explain each destructive action and ask permission before doing it – which, honestly, is exactly how I’d want to work with a very capable but very literal new hire who’s just been handed root access to my stuff.

By the end we had: neutralized the webshell, deleted the fake plugins and the malware-fighting-malware, wiped the 53,990 spam posts back down to my original 12, rotated WordPress’s security keys, reset my admin password, and cleaned up the robots.txt file and fake sitemap the spam campaign had been using to get itself indexed by search engines. Still working through the email side of things (turns out the free “G Suite for your domain” I set up back in the day got sunset by Google at some point and I never got the memo), but the site itself is clean now.

what you should go check on your own old stuff

If you have a WordPress site, blog, or anything else you set up years ago and haven’t logged into since – go look at it. Specifically:

  1. check your plugin list for anything you don’t recognize, especially gibberish names, or anything with a suspiciously generic name like “Newsletter Pro” that you don’t remember installing
  2. check your user list for accounts you didn’t create
  3. look at your site’s actual DNS and hosting – if you don’t remember where something is hosted anymore, that’s a sign it’s gone unattended for way too long
  4. check for huge error logs or unfamiliar files sitting in your uploads folder
  5. if a domain is doing something you don’t recognize – a mystery sitemap, a weird robots.txt, content in languages you don’t speak – that’s not a glitch, that’s a compromise

The lesson here is boring but true: an old, forgotten, unpatched site is exactly what gets found and quietly reused this way, for years, precisely because nobody’s watching it. Set a calendar reminder if you have to. I clearly needed one.

the honest disclosure part

This post was written by Claude (an AI) at my request, based on the actual investigation we did together today, after it read through my old posts here to match the voice. I’m publishing it close to as-written because, honestly, it felt like a fitting way to close out today’s saga. I did the important human part – authorizing every single change made to my own site, step by step – and Claude did the digging, the fixing, and now the writing.

one more thing

Since apparently people still occasionally read this thing: I’m currently looking for work. If today’s little saga is any indication of how I approach a genuinely ugly infrastructure problem, or you just need someone who can dig into a mess like this and come out the other side with a fixed system (and an unreasonably detailed blog post about it), drop a comment below or track me down.

update, the next day

So, funny thing. In the middle of turning this cleanup into a whole series of posts about the projects I’ve built with Claude, we found jasonarends.github.io – a Jekyll site I’d set up back in 2022 and then completely forgot about, same as I’d forgotten about this WordPress install in the first place. One post on it, titled “hello world,” explaining that I’d gotten fed up trying to theme WordPress and switched to Jekyll instead. I never wrote a second post. I just quietly stopped, and this WordPress site kept right on existing, unwatched, for four more years, until today.

Given that this whole incident happened because a piece of unmonitored WordPress infrastructure got compromised three separate times without anyone noticing, moving off WordPress entirely stopped being a someday-maybe idea and became the obvious next move. So: we wiped a different old droplet down to nothing, put a plain static site on it (no PHP, no database, no plugins, no admin login – nothing left for a webshell to hide in), wired up GitHub Actions so pushing a post to the repo builds and deploys it automatically, and moved this blog and the whole new project series over there. jasonarends.com now points at that instead.

Which means, a little absurdly, most of today’s actual WordPress hardening – the rotated keys, the cleaned plugin list, the fixed robots.txt – is now moot, since that install isn’t what’s serving the domain anymore. I don’t think that makes today wasted, though. We wouldn’t have known this needed to happen at all without doing the investigation first, and everything genuinely dangerous about the old setup – a live webshell, a backdoor account, three compromise waves nobody caught – got found and dealt with regardless of what happened to the hosting afterward. Sometimes the fix for a broken thing is fixing it. Sometimes it’s finding out you don’t need it anymore. Today was both.