WordPress Site Hacked With Casino Spam: How We Found and Removed the Malware at TourReview
French casino spam injected via a compromised database, not an outdated plugin. Full 5-phase cleanup — from malware removal to QA.
The alert
If your WordPress site suddenly started showing blocks of French text promoting online casinos — or Google Search Console flagged suspicious indexed content — the first instinct is to blame an outdated plugin. That's not always where the problem lives. That's what we found investigating TourReview's site, a B2B online reputation management SaaS for tour operators, a Workana client: the site showed casino spam (mystakecasinobet.com) repeated across multiple pages. The root cause wasn't in any plugin — it was sitting directly in the database, compromised through a backdoor user created from a leaked credential.
Project rule: never update with active malware
Updating plugins before identifying and removing the infection vector can obscure how the attacker got in, making a full cleanup harder down the line. Investigation came first: the injection was in the `wpuw_posts` and `wpuw_postmeta` tables, with no PHP files compromised. The vector was a backdoor user (`Af17lN8wTX`) created through database access or a leaked credential — permanently deleted once confirmed.
After the malware: a clean reinstall
After the removal, WordPress and 21 plugins were updated, including a nulled (pirated) Elementor Pro (version 3.8.0) that was removed and replaced with a legitimate license. The old installation was discarded, and a clean reinstall was promoted as the account's sole active WordPress instance, with uploads (325MB) restored from the pre-cleanup backup.
QA with a methodology built against the noise
Lighthouse tests on shared hosting showed a 14-to-23-point swing between identical runs of the same test — noise from the origin server, not from the optimizations applied. The solution was to measure by the median of 5 runs per page, rather than trusting a single result, to avoid making technical decisions based on a measurement that was really just statistical imprecision.
Result
23 pages and roughly 70 blog posts checked, all returning 200 OK. Full Wordfence scan with zero remaining malicious occurrences. Hardening applied: xmlrpc.php blocked, brute-force protection enabled, a dedicated Crazy Diamond admin account created for future maintenance. No technical item is blocking delivery — what remains depends solely on the client's own decisions (reconnecting the Instagram feed, the Akismet key), with no impact on the main scope already completed.