When Hackers Knocked on the Door – How We Brought the Sylhet Kidney Foundation Website Back to Life

There is a saying in cybersecurity:
“You don’t truly appreciate security until the day you lose it.”

A few days ago, Sylhet Kidney Foundation’s official website, kidneyfoundationsylhet.com, became the victim of a serious cyberattack. The website wasn’t simply displaying an error page—it had been completely compromised. The homepage was defaced, files had been deleted, website resources had disappeared, and the WordPress installation had been tampered with. At that point, the hosting environment could no longer be considered trustworthy.

It was one of those situations where many people would simply restore an old backup and hope everything would be fine again. Unfortunately, that approach rarely solves the real problem. If the attacker’s backdoor remains hidden somewhere inside the server, restoring the website may simply give the hacker another opportunity to return.

So instead of looking for a quick fix, I decided to rebuild trust in the entire system from the ground up.

For nearly three intensive days, I worked inside the hosting environment—examining the cPanel, reviewing the WordPress installation, inspecting the MySQL database, checking configuration files, removing suspicious components, rebuilding damaged resources, and hardening the entire platform. The domain is registered with GoDaddy, while the hosting environment is provided through XeonBD. Since the website runs on WordPress, every layer had to be treated as a potential attack surface. Rather than assuming anything was safe, every important component had to earn that trust again.

The recovery was not only about bringing the website online. It was about ensuring that it could stay online securely.

During the recovery process, a completely new landing page was developed along with several essential pages and features. The objective was not simply to replace what had been lost, but to build a cleaner, stronger, and more maintainable foundation for future growth.

At the same time, the WordPress environment was significantly hardened. Only trusted security solutions were introduced, security configurations were tightened, administrative access was strengthened, and unnecessary attack surfaces were reduced. Routine backup mechanisms were also established for both the MySQL database and the complete website resources, ensuring that recovery from any future incident would be much faster and more reliable.

Cybersecurity is often misunderstood. Many people believe that installing a security plugin is enough. Unfortunately, it isn’t.

Real cybersecurity is a continuous process. It means reducing vulnerabilities before attackers discover them, continuously monitoring systems, keeping software and plugins updated, maintaining verified backups, enforcing strong authentication, and applying the principle of least privilege. Above all, it means accepting one important reality—cyberattacks are not merely a possibility; they are an inevitability for every public-facing website.

Healthcare organizations carry an even greater responsibility. A hospital website is far more than an online brochure. It represents the institution’s credibility, professionalism, and commitment to serving patients. Patients rely on it for information, donors rely on it for confidence, and visitors rely on it for communication. Any successful cyberattack can damage not only the technology itself but also the trust that people place in the organization.

That is why website security should never be viewed simply as an IT expense. It is an essential component of organizational governance, enterprise risk management, business continuity, and reputation protection.

Today, kidneyfoundationsylhet.com is back online. The immediate cyberattack has been eliminated, the WordPress platform has been reinforced, regular backup procedures are now in place, and the website is operating on a much stronger security foundation than before.

Of course, no responsible cybersecurity professional will ever claim that a website is “100% secure.” That promise simply doesn’t exist in today’s digital world. What we can do is continuously reduce risk, strengthen defensive controls, monitor suspicious activities, respond rapidly to emerging threats, and make it extremely difficult for attackers to succeed. That is the true objective of cybersecurity.

For me, this recovery was never just about fixing a hacked website. It was about protecting an institution that serves thousands of people, restoring confidence in its digital presence, and demonstrating that cybersecurity is not a one-time project—it is an ongoing commitment.

The best cyberattack is always the one that never succeeds.

And that protection begins long before the hacker ever knocks on the door.