Pasan Enterprises: recovering a fully compromised website and rebuilding it as a secure business platform

Executive summary

When Pasan Enterprises approached Regalia Solutions, their website had been fully compromised. An attacker had taken control of the site, and the business content, product information and customer enquiry history the company had built up over years was sitting on the wrong side of a breach with no clear route back.

We were engaged to solve two problems at once. Recover whatever could be recovered from a hostile environment without carrying the compromise forward. And rebuild the entire web presence on a foundation that would not fail the same way twice.

What we delivered is a fast, professionally designed WordPress site running on a theme we wrote from scratch, supported by three custom plugins engineered specifically for this client’s workflow, and protected by a modern security stack in which every administrative login is brokered through a Cloudflare Zero Trust tunnel rather than exposed to the open internet.

About the client

Pasan Enterprises is an established Sri Lankan business whose website is a working commercial asset rather than a brochure. It carries their product and service information, it is where prospective customers form their first impression, and it is the channel through which enquiries and quotation requests arrive.

That context matters for understanding the severity of what happened. This was not a dormant site nobody would miss. It was a live front door to the business — and while it was compromised, that front door was both closed and dangerous.

The situation we inherited

Taking over a compromised environment is a fundamentally different discipline from building something new, and it is worth being clear about why.

When a site has been fully taken over, you cannot trust anything inside it. Not the files, not the database, not the user accounts, not the scheduled tasks, not the backups. An attacker who has held a site for any length of time will typically have left multiple ways back in, and many of those persistence mechanisms are designed specifically to survive a cleanup. A restore that looks successful can quietly reintroduce the original compromise — and the client discovers this weeks later when the site is defaced or blacklisted again.

This is why many agencies, handed a breached site, simply decline the recovery and quote for a rebuild from zero. It is the safe answer for the agency. It is also an expensive answer for the client, because it writes off everything they had built.

We were not willing to take that route without first exhausting the alternative. The client’s content had real commercial value, and recovering it was the difference between relaunching quickly and disappearing from the web for months.

The three constraints

Any one of those alone is routine. Solving all three at once is where the engineering judgement came in.

Our approach

Containment and assessment

The first phase was not building. It was understanding.

We treated the compromised environment as untrusted from the outset and worked from an isolated position rather than from inside the live system. Before touching recovery, we needed a clear picture of what had been affected, what remained intact enough to be worth extracting, and what would have to be rebuilt regardless.

That assessment shaped everything downstream. It told us what could realistically be salvaged, it set honest expectations with the client early rather than after weeks of silence, and it made clear that a clean rebuild of the platform itself was non-negotiable. Recovery would apply to the client’s content and data. It would not apply to the code that had failed them.

Strategic data recovery

Rather than accept the loss, our team worked methodically through every remaining avenue to reconstruct the client’s information. Content was extracted and validated in isolation, checked against what the business knew to be correct, and rebuilt into a clean environment. At no point was anything reconnected from the breached system into the new one.

The result was a genuine recovery. Pasan Enterprises did not start from zero.

A custom WordPress theme, written from scratch

We did not buy a theme and reskin it. The entire Pasan Enterprises theme was designed and coded by Regalia Solutions. Given how this project started, that was not a matter of preference.

Three custom plugins, engineered in-house

Third-party plugins are one of the most common weak points in any WordPress installation. Every additional plugin is another codebase the site owner does not control, another maintenance cycle they depend on, and another potential entry point. Plugin abandonment is routine — and an abandoned plugin with a disclosed vulnerability is exactly how sites like this one get taken over in the first place.

For the functionality this client needed most, we wrote our own.

Each plugin was written to fit this client’s actual workflow. No unused features, no licence fees stacking up year after year, no surprise deprecations, and no functionality the client is paying for but never uses.

Security architecture rebuilt from the ground up

Given how this project began, security was not a final checklist item. It shaped every decision from the first day. The centrepiece is a Cloudflare Zero Trust tunnel protecting all administrative access.

The WordPress admin login is the single most attacked endpoint on any WordPress site on the internet. Automated traffic hunting for it is constant, indiscriminate and relentless. Conventional defences try to survive that traffic through rate limiting, login attempt caps and firewall rules — all of which are a contest you have to keep winning forever.

Around that centrepiece, the site runs on a current, hardened configuration: traffic proxied and filtered through Cloudflare, a deliberately minimal and fully understood plugin footprint, disciplined update and backup practice, secure credential handling throughout, and correctly scoped administrative roles.

The practical effect for the client is that the failure mode which destroyed their previous site is no longer available to an attacker in the same form.

Performance, continuity and handover

A rebuild is also an opportunity, and we used it. The purpose-built theme gave the site a clean, fast front end with no inherited overhead. Content structure and URL continuity were handled carefully during reconstruction so the relaunch strengthened the client’s search position rather than starting it over.

We do not consider a project finished when a site goes live. The client was walked through their new admin environment, the quotation and testimonial workflows, and the access process for administrative logins under Zero Trust. Documentation and maintenance practice were left in place so the site stays secure through normal operation rather than depending on somebody remembering to do the right thing.

The client owns their theme, their plugins, their data and their infrastructure. Nothing about this build locks them to us.

Delivering within budget

Every decision above was made with the client’s budget in the room — and the budget genuinely improved the architecture.

• Writing our own theme and plugins removed recurring licence costs entirely, which compounds meaningfully year after year for a small business.

• Cloudflare Zero Trust delivered enterprise-grade access control at a cost a growing business can actually carry — which is precisely why we reached for it rather than proposing infrastructure the client would quietly stop paying for.

• Keeping the plugin footprint minimal reduced both the attack surface and the long-term maintenance hours the client would need to fund.

Security is usually sold as an expensive add-on, a line item that scales with spend. On this project the security came from making better architectural decisions, not from spending more money. That is a distinction we think more agencies should be honest about with clients of this size.

Results

Why this project represents how Regalia Solutions works

A great many teams can build a website. Considerably fewer can take over a site that has already been broken into, recover the client’s data out of a hostile environment, and hand back something demonstrably stronger than what existed before — all inside a small-business budget.