[ ABOUT ]
I’ve been taking WordPress apart since 2005.
I’m Katie Felten, a WordPress developer and security specialist. I work behind agencies as their white-label WordPress team: cleaning up hacked sites, auditing the ones they inherit, and taking the technical work their team doesn’t have time for.
THE SHORT VERSION
How I got here.
I started with WordPress at 17, teaching myself by reverse engineering themes while working my first tech support job. That habit of opening things up to see how they work never went away.
Before WordPress was my full-time work, I spent years in IT: running infrastructure, managing networks, and handling migrations for a college campus and small companies. It taught me how systems fail and how to explain the fix to people who just need it working.
I’ve freelanced since 2014, mostly through referrals from online business owners. Along the way I built sites as a developer at Atiba, and led development of the Key Conservation app, coordinating two development teams on a complex codebase.
Most recently I was a Technical Support Engineer at WP Engine, handling the tickets that needed deeper digging: malware remediation, security incident response, bot mitigation, database optimization, and performance troubleshooting across thousands of hosted sites. Now I bring that same work directly to agencies.
- 2005Working in WordPress
- 2014Freelancing since
- 2,400+Support tickets resolved at WP Engine
- 96%Customer satisfaction score
CASE FILES
Problems I’ve solved.
[FINAL-FIX]
Stopping a reinfection two previous cleanups missed
ProblemA nonprofit’s site had been hacked for the third time. Earlier cleanups removed the visible malware, but it kept coming back.
What I didParsed the access logs to rebuild the attack timeline and isolate the attacker IPs, which I then blocked. The logs showed 68 automated plugin-upload attempts in a 24-minute window. I decoded the obfuscated payload and traced it to a known malware family hiding behind a fake plugin, with command and control routed through public Ethereum RPC endpoints and about 20 fallbacks. The standard lockdown, DISALLOW_FILE_MODS, kept getting reverted by the platform, so it couldn’t be relied on.
ResultWrote and deployed a custom mu-plugin that blocks the ZIP upload endpoints the malware depended on, while leaving normal plugin and core updates working. With the attacker IPs blocked and the upload path closed, the reinfection cycle stopped where previous cleanups had failed. Payload sample, hashes, and timeline were preserved for future reference.
- Log parsing
- IP blocking
- Malware analysis
- Custom mu-plugin
[FORENSICS-REPORT]
Reconstructing an attack on an enterprise WordPress install
ProblemA well-known software company’s WordPress environment was compromised, including its staging site. User accounts had been deleted and the team needed to know exactly how the attacker got in.
What I didWent through the access logs request by request to identify every attacker IP and map their activity across production and staging. Traced the password reset requests the attacker used to take over accounts, cross-referenced them against the user tables to confirm which accounts were hit and which were deleted, and followed the path the attacker took from production into staging.
ResultDelivered a full incident report: a minute-by-minute timeline, every attacker IP, the exact entry vector, each affected account, and how the attacker reached staging. Each finding was paired with the fix that closed it, so the client’s security team had a clear record of what happened and confidence that the same path couldn’t be used again.
- Incident forensics
- Access log analysis
- User audit
- Incident report
[BULK-FIX]
Cleaning up a 16-site malware campaign
ProblemOne customer had sixteen compromised sites sharing the same infection. Cleaning them one at a time risked missing a backdoor and letting it spread back.
What I didIdentified the shared infection pattern on the first sites, then used it as a fingerprint across all sixteen. On each install I checked core files against official checksums with WP-CLI, searched for recently modified PHP files, inspected mu-plugins and the uploads folder for files that didn’t belong, and reviewed the user tables for rogue administrators. Worked alongside a third-party security vendor so nothing was duplicated or missed.
ResultEvery site cleaned against the same checklist and handled as one coordinated incident instead of sixteen separate fires, closing the gap that would have let one missed backdoor reinfect the rest.
- WP-CLI
- Backdoor removal
- Multi-site cleanup
- Vendor coordination
[PERFORMANCE-GAIN]
Cutting database bloat across a hosting pod
ProblemAround 30 law firm sites on shared infrastructure were weighed down by bloated autoloaded options, which WordPress loads into memory on every single page request.
What I didUsed WP-CLI to list every autoloaded option on each site, sorted by size. Separated what WordPress and active plugins actually needed from leftovers: options from plugins removed long ago, expired transients, and large serialized data that had no reason to load on every page. Took a backup, set large non-critical options to stop autoloading, and removed the orphaned data.
ResultMost sites cut their autoload size roughly in half, lowering memory use and database load on every request across the whole group.
- WP-CLI
- MySQL
- Autoload tuning
- Database cleanup
Work performed as a Technical Support Engineer at WP Engine, 2024 to 2026. Client names and identifying details have been removed.
HOW I WORK
What you can count on.
- Root cause, not symptoms. A cleanup isn’t done until I know how the attacker got in and that door is closed.
- Staging first. Changes are tested before they touch a live client site.
- Everything documented. You get notes the next developer can actually use, and a summary you can forward to your client.
- Plain language. I explain what happened and why in terms your client will understand.
- Invisible by default. Your brand, your client relationship. I stay behind the scenes.
TOOLS AND SKILLS
What I work in.
Security and forensics
- Malware and backdoor removal
- Log analysis
- Incident reports
- Login hardening
- Cloudflare WAF and bot rules
Performance
- Autoload and database tuning
- Caching
- Core Web Vitals
- Slow query diagnosis
Development
- PHP
- WooCommerce
- REST API
- React and React Native
- Git
Server and tooling
- SSH and Linux
- WP-CLI
- MySQL
- Managed WordPress hosting
OFF THE CLOCK
Outside of work.
I live near Savannah, Georgia, and work from a home office I share with my dog, husband, and a houseplant collection that keeps growing,
Have a site that needs a second set of eyes?
Send what you’re seeing. You’ll get a clear read within one business day.