A WordPress site kept reinfecting itself after every cleanup. Malicious files reappeared because the regenerating script was still on the server, and standard scans were not finding it. The site ran on Nginx through GridPane, and the client wanted a permanent fix without restoring from a backup.

I traced the reinfection path across the full stack—not only wp-content. That included droppers, rogue cron jobs, mu-plugins, and backdoors outside typical plugin and theme folders. After removing the persistence layer, I cleaned the regenerating payload and hardened the Nginx + GridPane setup so the same attack path could not return.

Result: malware stopped regenerating, the site stayed live with existing content, and no full backup restore was required.