Malware removed and two sister tour company websites locked down
In October 2023 visitors to the Snowy Owl Sled Dog Tours website started seeing spam pop-ups and redirects. The site also ran an outdated PHP version, an outdated theme and several unused plugins, and it had not been updated since it was built.
Snowy Owl Sled Dog Tours and White Wolf Rafting are family owned sister companies in Canmore, Alberta: dog sled tours since 1983 and whitewater rafting on the Kananaskis River. When spam pop-ups and redirects appeared on the Snowy Owl website in October 2023, Codiffy removed the malware, found and cleaned the infected sister site on the same server, locked both sites down with new admin passwords and two-factor login, then updated everything and moved both sites to PHP 8.2. Codiffy had also optimized the speed of both sites in 2020 and 2021.
ClientSnowy Owl Sled Dog Tours and White Wolf Rafting
IndustryDog sled tours and whitewater rafting
Based inCanmore, Alberta
PlatformWordPress
What we didMalware removal, lockdown, updates, PHP 8.2 and speed optimization
Our roleWe did not build these sites. We optimized, secured and maintained them.
In October 2023 visitors to the Snowy Owl Sled Dog Tours website started seeing spam pop-ups and redirects. The site also ran an outdated PHP version, an outdated theme and several unused plugins, and it had not been updated since it was built.
Approach
We removed the malicious code and a backdoor, traced the returning pop-ups to the sister site, White Wolf Rafting, on the same server and cleaned it too, reset every admin password, set up two-factor login for all admins and monitored both sites for 10 days.
Result
The infection was removed and the way in closed within about two weeks of the first report. By 6 November 2023 both sites were fully updated and on PHP 8.2.
About the two companies
Snowy Owl Sled Dog Tours is a family owned dog sledding company, running since 1983, with winter sled tours and summer dog cart and kennel tours in Kananaskis Country. White Wolf Rafting, its sister company, runs whitewater rafting tours on the Kananaskis River in the Canadian Rockies. Both are based in Canmore, Alberta, and both websites sat on the same hosting account. We did not build either site: we made them faster, cleaned them and looked after them.
What happened
On 20 October 2023 visitors started seeing spam pop-ups and redirects when they opened the Snowy Owl website, and the company asked for urgent help. The site was also running an outdated PHP version, an outdated theme and several unused plugins, and no updates had been applied since the site was built.
How we cleaned it
The first cleanupMalicious code removed from a file in a core folder and from index.php, a backdoor file deleted from the site root, and the plugin the attacker was using to inject code removed. A report followed with recommendations on risky plugins, outdated themes and PHP (23 to 24 October 2023).
The source of the returnWhen the pop-ups came back, we traced them to White Wolf Rafting on the same server, found it infected too and, with the company’s approval, ran the same cleanup there (26 to 30 October 2023).
Locked downEvery admin password on both sites reset, two admin accounts that were no longer needed removed, and two-factor login set up for every admin through Wordfence.
WatchedBoth sites monitored for 10 days. One last flare up on 1 November 2023, traced to the same plugin, was fixed the same day.
Keeping it closed
Under a maintenance plan for both sites, we created staging copies, updated WordPress, the themes and the plugins and moved both sites from an outdated PHP 7 version to PHP 8.2, testing every update on staging before it reached the live sites (2 to 6 November 2023). Later we added reCAPTCHA to the enquiry form to stop spam enquiries, managed user access and two-factor resets for the company’s marketing contractor, and fixed a page fault within minutes on 4 March 2024.
Speed optimization
Before the security work, we optimized the speed of both sites.
Snowy Owl Sled Dog Tours, December 2020
In December 2020 the home page scored 12 on Google PageSpeed mobile and 42 on desktop, with a GTmetrix grade of F (6%). We installed and configured NitroPack, did extra manual optimization and switched off the conflicting image plugin. The remaining weight is third party code: analytics, the tag manager and web fonts. Afterwards it scored 68 on mobile and 95 on desktop, with GTmetrix C (63%).
Test
Before
After
Google PageSpeed, mobile
12
68
Google PageSpeed, desktop
42
95
GTmetrix grade (performance)
F (6%)
C (63%)
Largest contentful paint (GTmetrix)
16.6 s
1.0 s
Pingdom load time
9.77 s
886 ms
WebPageTest fully loaded
11.3 s
3.6 s
Before
After
Google PageSpeed Insights mobile, before and after.
Before
After
Pingdom, before and after.
White Wolf Rafting, April 2021
In April 2021 the home page scored 13 on Google PageSpeed mobile and 48 on desktop, with a GTmetrix grade of D (60%). We installed and configured NitroPack and switched off WP Rocket. Afterwards it scored 99 on mobile and 95 on desktop, with GTmetrix A (97%).
Test
Before
After
Google PageSpeed, mobile
13
99
Google PageSpeed, desktop
48
95
GTmetrix grade (performance)
D (60%)
A (97%)
Pingdom load time
1.22 s
530 ms
Google PageSpeed Insights, before and after.GTmetrix, before and after.
The infection was removed and the entry point closed within about two weeks of the first report, with both sister sites behind two-factor login. By 6 November 2023 both sites were fully updated and on PHP 8.2, and the company signed a maintenance plan for both sites.
13 April 2021White Wolf Rafting speed optimization
23 to 24 October 2023Snowy Owl malware cleanup and security report
26 to 30 October 2023White Wolf Rafting found infected and cleaned, both sites locked down
1 November 2023A last flare up fixed the same day
2 to 6 November 2023Both sites updated on staging first, PHP 8.2
Questions about this project.
Why did the pop-ups come back after the first cleanup?
The sister site, White Wolf Rafting, sat on the same server and was infected too. Once we cleaned both sites and locked them down, the infection stopped.
What was done to keep the malware out?
Every admin password on both sites was reset, two-factor login was set up for every admin, admin accounts no longer needed were removed, both sites were monitored for 10 days, and then WordPress, the themes and the plugins were updated and PHP was moved to 8.2.
Did Codiffy build these websites?
No. We optimized their speed in 2020 and 2021, then cleaned, secured and maintained them.
More case studies
Randy Clark & Associates
Service business
WordPress
Speed optimization
Speed work, a rebuild and a malware cleanup for a hair replacement studio
Challenge
In September 2021 the studio's home page scored 13 out of 100 on Google PageSpeed mobile. The site also needed more and better images: the before and after photos were very low resolution.
Result
Google PageSpeed mobile went from 13 to 97 in September 2021, the rebuilt site went live on 25 May 2023, about seven weeks after kickoff, and Guardian Shield Lite removed the fake Cloudflare malware.
