Senior WordPress Security & Digital Forensics Specialist

Overview We are looking for a highly experienced WordPress Security & Digital Forensics Specialist to investigate two WordPress websites that continue exhibiting suspicious behavior despite extensive remediation. Please read this carefully before applying. This is NOT a standard malware cleanup project. The websites have already been through: Malware removal Security hardening Wordfence Premium installation and configuration Firewall protection File integrity monitoring Continuous security monitoring Server-level investigation Current malware scans show the websites as clean, and no new malware files have been detected since the original cleanup. However, suspicious activity continues, which indicates this requires a deeper forensic investigation, not another malware scan. If your approach is simply to run Wordfence, reinstall WordPress, or perform a generic cleanup, this project is not a good fit. Current Issues We need someone to determine the root cause of the following: Spam blog posts continue appearing automatically. Hundreds of spam pages have been indexed by Google. Adult/Japanese SEO spam is ranking under our client's domain. Unknown /items/[random-id]/ URLs are appearing in search engines even though this route does not exist within WordPress. We need to determine whether the issue originates from WordPress, the database, the server, scheduled tasks, a hidden backdoor, or another persistence mechanism. The goal is to identify how this is happening, not simply remove the visible symptoms. What We've Already Done To avoid duplicate work, please note that the following has already been completed: Multiple malware scans Malware removal Security plugin installation (Wordfence Premium) Firewall configuration WordPress hardening File integrity verification Initial server investigation Continuous monitoring and attack logging Wordfence is actively blocking thousands of malicious requests, but the issue described above still persists. Responsibilities You will perform a complete forensic investigation, including but not limited to: WordPress core integrity verification Database analysis Plugin and theme code review User account audit Hidden backdoor detection Persistence mechanism identification Scheduled task (WP-Cron/System Cron) review Server log analysis Access log review PHP execution analysis Investigation of unknown URL generation SEO spam analysis Root cause identification Permanent remediation recommendations Required Experience We're looking for someone with proven experience in: Advanced WordPress security WordPress incident response Digital forensics Malware analysis PHP security MySQL investigations Linux server administration Apache/Nginx log analysis Wordfence Cloudflare SEO spam attacks Hidden backdoors and persistence mechanisms Please include examples of similar investigations you've completed. We Will Provide To help speed up the investigation, we'll provide: Wordfence logs Server logs Security reports IP addresses Timeline of events Previous investigation notes Administrator access Any additional data required during the investigation Deliverables By the end of the engagement, we expect: Identification of the root cause Explanation of the attack vector or persistence mechanism Documentation of findings Permanent remediation plan Verification that the websites are secure Recommendations to prevent recurrence To Apply Please answer the following: Have you handled similar WordPress forensic investigations where the site appeared clean but suspicious behavior continued? What was the root cause in one of those cases? How would you approach investigating this scenario? Please share relevant case studies or examples of similar work.