The Problem
GOCACTUS has been building and hosting WordPress sites for nearly twenty years. That is a long time for a portfolio to accumulate configuration — plugins added for a campaign that ended, hosting decisions made under a different set of constraints, user tables that nobody had reason to look at.
What surfaced first was not a security alert. It was support requests: sites feeling slow, things behaving oddly. Those requests were the symptom that prompted a proper look across the fleet.
The audit covered several long-standing, large-scale, active properties, and found vulnerabilities in every one of them. Underneath the performance complaints was a portfolio quietly absorbing automated abuse:
- Bot traffic degrading performance badly enough that real users noticed and complained
- Roughly 200 spam user accounts created per day, accumulating in production databases
- Software vulnerabilities across the portfolio, none of them individually dramatic, collectively a real exposure
- Large file storage and hosting arrangements that had drifted out of shape over two decades
None of this was neglect. It is what happens to any portfolio left running long enough without somebody periodically looking at the whole of it rather than one site at a time.
Our Approach
The properties were live, active and client-facing, so remediation had to happen without downtime. The constraint shaped the method: measure first, establish what normal looked like, then change things in an order where each step could be verified before the next.
Audit the Fleet, Not the Site
Look across the whole portfolio at once. Problems that look like one site's bad luck turn out to be a pattern when you can see all of them together.
Evidence from Server Reports
Work from server activity reports and vulnerability recommendations, so the picture came from measured traffic rather than from what the symptoms suggested.
Prove It Thirty Days Later
Commit to a 30-day verification window. A fix that cannot be shown to have worked against a prior baseline is an assertion, not a result.
The Solution
Remediation ran across the portfolio in parallel with keeping every property live. The work split between stopping the incoming abuse, cleaning up what it had already left behind, and tidying the accumulated hosting decisions underneath.
Cross-Property Vulnerability Audit
Audited performance and security across multiple long-standing properties simultaneously, reviewing server activity reports alongside software vulnerability recommendations to build one picture of the portfolio rather than several disconnected ones.
Bot Mitigation & DNS-Level Protection
Implemented bot mitigation and DNS-level protections so automated traffic was filtered before it reached the origin servers — stopping the load at the edge rather than absorbing it and paying for the capacity.
Production Database Cleanup
Removed accumulated spam user accounts from production databases. Blocking new signups stops the problem growing; clearing the existing records is what returns the data to something the team can actually reason about.
Storage & Hosting Consolidation
Addressed large file storage and consolidated hosting arrangements that had drifted over nearly twenty years, reducing the number of places a problem could hide and the number of configurations anyone had to keep in their head.
30-Day Verification Reporting
Measured the result against the previous 30-day average rather than against impressions. The reporting is what turned "the sites feel better" into numbers the client could see, and what would have caught the work falling short if it had.
The Results
The thirty-day reports were unambiguous. Spam account creation went from roughly 200 bot users daily to zero. Support requests for bot-related performance issues stopped entirely. Performance across the portfolio came in 53% higher than the previous 30-day average.
The support requests are the number worth dwelling on. They were what started the engagement, and they were a proxy for something harder to measure — people relying on these sites finding them frustrating enough to say so. That signal went to zero.
Ongoing monitoring means the portfolio no longer depends on complaints as its early warning system. The next drift gets caught by reporting rather than by somebody noticing a site feels slow.