24/09/2026
Somebody had a key to this website for a month, and it didn't show up anywhere.
When we found it, it wasn't well hidden. It was hidden in the one place you'd think to look.
Whoever broke in had added themselves an admin account. Then they edited the page in WordPress that lists your users, so their own account was quietly removed from that list before you ever saw it. The count at the top was adjusted to match.
You open Users, you see 5 people, and it says 5. There were 6.
Checking from the server showed it in seconds, because that reads the database directly instead of asking the website to draw you a page.
That's the bit worth taking away. If a site has been tampered with, the site is the last thing you should trust to tell you about it. It can show you a version where everything looks fine, and it will.
The account had been sitting there a month before anyone noticed. Nobody was careless. There was simply nothing to see.
If you've got a WordPress site and nobody has looked at it properly in a while, that's not a crisis. It's just overdue.
Send us your address and we'll have a look π
https://hotspot.digital/maintenance-packages/