The WordPress backend for a Contao agency

What they needed

arebo Design in Rendsburg is a full-service agency: print, corporate design, web design and media-education projects. Most of their sites run on Contao. For the WordPress ones they needed someone who knows WordPress from the inside, on call rather than full time.

What I do

Backend work on their WordPress projects as it comes up: custom code, fixes, updates and security. Most of it happens directly on the sites, so it leaves no repository behind.

In mid-2026 one of their clients’ sites was hacked the typical WordPress way. An upload hole let the attackers in, and from there they spread scripts disguised as WordPress’s own files across the whole install: fake core files, fake plugins and themes, and new users of their own. Nothing was defaced, so they were after something other than attention. I locked down the site and the server first, then rebuilt it from a clean install, cleaned up the database, and handed over the hardening steps to keep it that way. The way in was most likely an outdated plugin with a known hole.

Why it matters

The agency can take on WordPress projects next to its Contao work, and its clients have someone who answers when something breaks.