Halo Place

Project Delivered — Live & Operational

The Halo Place website is live at haloplacett.com. All pages, the direct-booking engine, contact forms, SEO configuration, and the custom block theme are deployed and functioning as intended.

What Went Wrong

During the migration to the shared hosting server, the site was repeatedly infected with malware shortly after each fresh upload. The issue persisted across multiple deployment attempts and caused a delay in final delivery.

Root Cause

The WordPress installation on the shared hosting server shipped with a default administrative user account:

• Username: admin
• Password: root

This combination is one of the most common targets for automated malicious bots. Because this is not a default account I normally expect to find in fresh WordPress installations, I did not check for or remove it during the initial deployment. Bots were able to authenticate with these credentials and inject malicious code into the site within minutes of each upload.

Why It Re-Occurred on Every Upload

Each time I uploaded a fresh, clean version of the site, the default admin user was present in the database export. The bots had already mapped the domain, so they re-authenticated and immediately re-infected the site after each re-deployment. This created a frustrating cycle that masked the real root cause for several rounds of troubleshooting.

This was entirely my oversight. I take full responsibility for not auditing the user table before the first deployment.

What Was Done to Fix It

Security Measures Now in Place

• Web application firewall (WAF) — blocks malicious requests at the server level before they reach WordPress.
• Malware scanner — scheduled automatic scans; alerts on any suspicious file changes.
• Login attempt limiting — brute-force protection; rate-limited login attempts per IP.
• Security alerts — real-time notifications for admin logins, file modifications, and plugin updates.
• IP whitelisting — the domain and server IP have been submitted to and whitelisted with major security vendors.
• VirusTotal verification — independent multi-vendor analysis shows the domain as clean.

View VirusTotal Analysis →

Maintenance & Recommendations

What I'll Do as Part of Ongoing Maintenance

• Keep WordPress core, the custom theme, and all plugins updated to the latest stable versions.
• Monitor the malware scanner and security alerts on a regular cadence.
• Verify the firewall and login-limiting rules remain active.
• Provide a clean database export and full-site backup for your records.

Deliverable Summary