BM Mobil: Taking Over and Securing a Corporate WordPress Site
We took over a corporate WordPress site after a security incident. We regained control safely, checked it for backdoors (hidden ways in), closed the common entry points and gave the business a ranked upgrade plan. We also designed its vehicle tracking app.
- Project
- Takeover & hardening
- Our role
- WordPress site build & app UI/UX design (Figma)
- Platform
- WordPress + Elementor
- Country
- Türkiye
- Year
- 2025
The challenge
A site that needed a safe pair of hands
BM Mobil sells and installs vehicle tracking, fleet management and in-vehicle camera systems across Turkey. Its corporate WordPress site, in two languages, had a security incident. The original agency was no longer involved. So BM Mobil needed someone to take the site over and make it trustworthy again.
Inherited setup, limited access
The site ran on a paid theme and page builder set up by the previous agency. It had been moved file by file from an older server. It also sits inside the client's own network, reachable only over VPN.
Our approach
Regain control safely
We connected through the client's VPN and hosting panel. We reset the admin passwords directly in the database, so control did not depend on any channel that might itself be hacked.
Check before changing anything
We checked the uploads folder, must-use plugins and plugin code for planted files. We also reviewed every plugin that talked to outside servers before deciding what stayed on.
Close the common entry points
We applied the standard WordPress security fixes, both on the web server and inside WordPress. We removed files that leaked server details and added a security plugin for monitoring.
Rank what is left
Instead of a risky blind upgrade, we ranked the remaining work by risk and planned safe upgrade paths. Licensing and infrastructure decisions stayed with the client.
A vehicle tracking app, designed in Figma
Alongside the website we designed BM Mobil's fleet tracking app. A map shows every vehicle in a colour for its state. Tapping one opens its plate, driver, speed, distance, time and idling. "My vehicles" starts with a gauge of how many vehicles are moving, then lists each one with location, speed, distance and last update. A vehicle page adds make, fuel, colour and chassis details, its exact location and nearest point, and the last trip. It also has a button to start live camera monitoring from the front, wheel-arch and cabin cameras. A performance view charts daily travel time, weekly distance and how many vehicles were tracked.
Screens
Inside BM Mobil
How we delivered
From first brief to running in production
-
01
AuditRegain access
Connected over the client's VPN and hosting panel and reset the admin login details directly in the database.
VPN accessCredential resetPanel access -
02
Backdoor check
AuditScanned uploads, must-use plugins and plugin code for planted files, and reviewed plugins that contact outside servers.
Uploadsmu-pluginsPlugin review -
03
Cleanup
CleanupRemoved files that leaked server details and deactivated plugins that were not needed.
Leaky filesUnused plugins -
04
Security fixes
HardeningApplied security fixes on the server and inside WordPress, and added security monitoring.
Server rulesWordPress configMonitoring -
05
Risk roadmap
OperationsRanked the remaining risks and planned safe upgrade paths.
Risk rankingUpgrade plan
Results
What is running today
A clean starting point
The check after the takeover found no backdoors, and the site kept running normally during the cleanup.
Common attack paths closed
The usual WordPress entry points are closed, and a file uploaded through the media library cannot be run as code.
A clear roadmap
The client has a ranked, costed list of the remaining upgrades instead of an open-ended worry.
More work
Other things we built and run
EMA Mühendislik
A new website design for EMA Mühendislik, a supplier of process equipment such as heat exchangers, pumps, valves and rupture discs. The work ran from an August 2023 design brief through revision rounds to the Turkish translation in early 2024.
RiderSticker
An online shop for custom motorcycle, off-road and bicycle name stickers, based in Istanbul. Built on Laravel and Livewire with a live sticker designer on the homepage, English and Turkish versions, team discount codes, and iyzico card checkout.
Oksijen Events
Oksijen Events runs brand launches, dealer meetings, festivals and activations for companies like Hepsiburada, Borusan and Şişecam. We designed and built their Turkish-language WordPress site. It is built around a video showreel, an awards timeline and a set of event case pages.