Book a free call
Case study: In Order to Succeed

Hidden admin powers, a fake Cloudflare redirect and a backdoor, removed by Guardian

Customer accounts had been given administrator powers in secret, a script sent visitors to a fake Cloudflare check page, and a backdoor was hidden in a theme file.

Talk about a project like this Visit In Order to Succeed

In short

In Order to Succeed is a professional organizing and move management firm in Connecticut, New York and Florida. Codiffy built its WordPress website and protects it with Guardian Shield Lite. Guardian found customer accounts that had been given administrator powers in secret and removed those powers, removed a script that sent visitors to a fake Cloudflare check page, and on 9 September 2026 found and removed a backdoor that had been hidden in a theme file since November 2025.

The short version

Challenge
Customer accounts had been given administrator powers in secret, a script sent visitors to a fake Cloudflare check page, and a backdoor was hidden in a theme file.
Approach
We protect the site with Guardian Shield Lite, the WordPress security plugin we develop. It found each threat on its own and removed it.
Result
All three threats removed automatically. The backdoor, planted in November 2025, was found and removed on 9 September 2026 during a regular scan.

About In Order to Succeed

In Order to Succeed is a professional organizing and move management firm serving Connecticut, New York and Florida since 1998. Codiffy built its WordPress website (see the website case study) and protects it with Guardian Shield Lite, the WordPress security plugin we develop.

What Guardian found and removed

  • Customer accounts with hidden administrator powers Customer accounts on the site had been given administrator powers directly, while they still looked like ordinary customers in the Users list. Attackers use this to keep a way back in after every password has been changed. Guardian found the accounts and removed those powers automatically.
  • A redirect to a fake Cloudflare check A malicious script sent visitors to a fake Cloudflare “verify you are human” page. Pages like this are a known trick to get visitors to run malware on their own computers, so the risk was to the firm’s clients, not only to the website. Guardian recognised the script and removed it.
  • A hidden backdoor On 9 September 2026, during one of its regular scans, Guardian found a backdoor disguised as a code editor file inside the theme. It let anyone run commands on the website’s server without logging in. Guardian kept a protected copy of the file, removed it and sent an incident report, which showed the file had been planted on 11 November 2025, ten months before.

How Guardian protects the site

Guardian checks the site’s files, administrator accounts, scheduled tasks and the scripts on its pages around the clock and reports to our hub every 15 minutes. Known malware is removed the moment it is found, always after a protected copy is kept; anything that is only suspicious is reported to us and left in place for a person to check. Code changes stay locked unless an approved person unlocks them for a limited time, and a 30-day security report is ready to download whenever the client wants one.

The same malware on another site

The fake Cloudflare redirect is not unique to this site. We found the same malware on Randy Clark & Associates, a site we built, and Guardian Shield Lite cleaned it there too.

Technology

WordPress and Guardian Shield Lite. More on our WordPress malware removal and monitoring and ongoing protection pages.

The product behind it

WordPress security plugin

Guardian Shield Lite

Our WordPress security plugin: code stays locked, known malware is removed with evidence kept, and every site reports to one hub.

  • Code locked, changes in recorded windows
  • Known malware removed, evidence kept
  • Every site watched from one hub
Ask about Guardian See how Guardian works

How the project ran

  1. 11 November 2025Backdoor planted in a theme file
  2. 9 September 2026Guardian finds the backdoor, keeps a copy and removes it

Questions about this project.

What did Guardian Shield Lite find on this site?

Three threats: customer accounts that had been given administrator powers in secret, a script that sent visitors to a fake Cloudflare check page, and a backdoor hidden in a theme file. Guardian removed all three automatically.

What is a fake Cloudflare check page?

A page that imitates Cloudflare's "verify you are human" step. It is a known trick to get visitors to run malware on their own computers, so a site that sends visitors there puts its clients at risk.

How long had the backdoor been there?

Guardian's incident report showed it had been planted on 11 November 2025. Guardian found and removed it on 9 September 2026.

Can Guardian Shield Lite protect my site?

Guardian Shield Lite comes with our website security and maintenance plans: we install it, set it up and watch it for you. Book a free call and we will look at your site.

More case studies

Snowy Owl Sled Dog Tours and White Wolf Rafting
  • Service business
  • Website security
  • Malware removal

Malware removed and two sister tour company websites locked down

Challenge
In October 2023 visitors to the Snowy Owl Sled Dog Tours website started seeing spam pop-ups and redirects. The site also ran an outdated PHP version, an outdated theme and several unused plugins, and it had not been updated since it was built.
Result
The infection was removed and the way in closed within about two weeks of the first report. By 6 November 2023 both sites were fully updated and on PHP 8.2.
Read the story: Malware removed and two sister tour company websites locked down
Randy Clark & Associates
  • Service business
  • WordPress
  • Speed optimization

Speed work, a rebuild and a malware cleanup for a hair replacement studio

Challenge
In September 2021 the studio's home page scored 13 out of 100 on Google PageSpeed mobile. The site also needed more and better images: the before and after photos were very low resolution.
Result
Google PageSpeed mobile went from 13 to 97 in September 2021, the rebuilt site went live on 25 May 2023, about seven weeks after kickoff, and Guardian Shield Lite removed the fake Cloudflare malware.
Read the story: Speed work, a rebuild and a malware cleanup for a hair replacement studio

Have a project like this?

Book a free 30-minute call. You'll leave with a clear plan and a fixed quote, whether you hire us or not.

Book my free call
Free call, no obligationBook my call