Skip to main content
Reactll — AI & Software Engineering Reactor Technology
BM Mobil: Taking Over and Securing a Corporate WordPress Site

BM Mobil: Taking Over and Securing a Corporate WordPress Site

We took over a corporate WordPress site after a security incident. We regained control safely, checked it for backdoors (hidden ways in), closed the common entry points and gave the business a ranked upgrade plan. We also designed its vehicle tracking app.

Project
Takeover & hardening
Our role
WordPress site build & app UI/UX design (Figma)
Platform
WordPress + Elementor
Country
Türkiye
Year
2025

The challenge

A site that needed a safe pair of hands

BM Mobil sells and installs vehicle tracking, fleet management and in-vehicle camera systems across Turkey. Its corporate WordPress site, in two languages, had a security incident. The original agency was no longer involved. So BM Mobil needed someone to take the site over and make it trustworthy again.

Inherited setup, limited access

The site ran on a paid theme and page builder set up by the previous agency. It had been moved file by file from an older server. It also sits inside the client's own network, reachable only over VPN.

Our approach

Regain control safely

We connected through the client's VPN and hosting panel. We reset the admin passwords directly in the database, so control did not depend on any channel that might itself be hacked.

Check before changing anything

We checked the uploads folder, must-use plugins and plugin code for planted files. We also reviewed every plugin that talked to outside servers before deciding what stayed on.

Close the common entry points

We applied the standard WordPress security fixes, both on the web server and inside WordPress. We removed files that leaked server details and added a security plugin for monitoring.

Rank what is left

Instead of a risky blind upgrade, we ranked the remaining work by risk and planned safe upgrade paths. Licensing and infrastructure decisions stayed with the client.

A vehicle tracking app, designed in Figma

Alongside the website we designed BM Mobil's fleet tracking app. A map shows every vehicle in a colour for its state. Tapping one opens its plate, driver, speed, distance, time and idling. "My vehicles" starts with a gauge of how many vehicles are moving, then lists each one with location, speed, distance and last update. A vehicle page adds make, fuel, colour and chassis details, its exact location and nearest point, and the last trip. It also has a button to start live camera monitoring from the front, wheel-arch and cabin cameras. A performance view charts daily travel time, weekly distance and how many vehicles were tracked.

Screens

Inside BM Mobil

How we delivered

From first brief to running in production

  1. 01

    Audit

    Regain access

    Connected over the client's VPN and hosting panel and reset the admin login details directly in the database.

    VPN accessCredential resetPanel access
  2. 02

    Backdoor check

    Audit

    Scanned uploads, must-use plugins and plugin code for planted files, and reviewed plugins that contact outside servers.

    Uploadsmu-pluginsPlugin review
  3. 03

    Cleanup

    Cleanup

    Removed files that leaked server details and deactivated plugins that were not needed.

    Leaky filesUnused plugins
  4. 04

    Security fixes

    Hardening

    Applied security fixes on the server and inside WordPress, and added security monitoring.

    Server rulesWordPress configMonitoring
  5. 05

    Risk roadmap

    Operations

    Ranked the remaining risks and planned safe upgrade paths.

    Risk rankingUpgrade plan

Results

What is running today

A clean starting point

The check after the takeover found no backdoors, and the site kept running normally during the cleanup.

Common attack paths closed

The usual WordPress entry points are closed, and a file uploaded through the media library cannot be run as code.

A clear roadmap

The client has a ranked, costed list of the remaining upgrades instead of an open-ended worry.

Building something similar?

Tell us what you are working on and how it compares. You will talk to an engineer, not a salesperson.

Talk to an Engineer Reply Within a Day