A nonprofit was paying full commercial price for Google Workspace while running a Google Ad Grant. Getting the 75% nonprofit discount took a seat cleanup, a lost admin account, an AI support agent that misread the plan, and a downgrade nobody mentioned up front.
Read Details
Repeated malware cleanups failed across a marketing agency’s WordPress portfolio because a former contractor’s hosting account and a staff administrator’s stolen credentials remained active.
Read Details
A law firm’s WordPress site kept getting reinfected with ClickFix malware after every professional cleanup. The root cause was a forgotten administrator account with a valid password that was never rotated.
Read Details
A Shopify Plus store redirected shoppers to scam pages while scanners reported it clean. The cause was an orphaned app script loading cloaked malware.
Read Details
A Melbourne optometry practice’s Wordpress site took around twelve seconds to become usable on mobile. With no staging, a redesign already in progress, and a live ad-campaign landing page that couldn’t go down, I made reversible, measured changes that cut server response by 70% and halved the page weight, then tested one ‘obvious’ deeper win thoroughly enough to correctly defer it to the redesign.
Read Details
A digital-marketing agency hired me to document a Google Ads Manager Account (MCC) takeover that was already cleaned up. The investigation had never been done, so we rebuilt it from the logs and found the real root cause: a terminated employee’s account that was never disabled.
Read Details
Two WordPress sites, built by an outside freelancer and then quietly controlled through administrator access that was never revoked. One was stuffed with gambling spam; the other carried a file-manager backdoor. The owner didn’t even have an account on one of his own sites.
Read Details