If your business website runs on WordPress, there is one plugin worth checking today. Rank Math is a popular search engine optimisation (SEO) plugin, and according to a security notice Rank Math published on 16 October, some copies of its paid version, Rank Math PRO, contained malware.
What happened
As reported by The Hacker News, copies of Rank Math PRO that were downloaded from rankmath.com, or delivered as automatic updates, between 20:02 UTC on 15 October and 07:12 UTC on 16 October were affected. In Sydney time that is roughly 7am to 6pm on Thursday 16 October. The report describes the malware as a backdoor that can restore itself, meaning it can come back after being removed.
Rank Math’s advice, as reported, is blunt: any site that installed and activated one of those copies should be treated as compromised.
Why this matters for small businesses
This was not a case of someone ignoring updates. Sites that did the right thing and updated promptly are the ones that could have received the bad copy. A backdoor gives an attacker a way back into your website, which can be used to deface it, redirect your visitors to scams, or steal details from forms and online orders.
What to do now
- Ask whether you use Rank Math PRO. If someone else manages your website, ask them directly. The notice concerns the paid PRO version.
- Check the dates. Find out whether it was installed or updated during that window on 16 October.
- If it was, do not just update and move on. Treat the site as compromised: restore from a clean backup taken before 16 October, change all WordPress, hosting and database passwords, and remove any administrator accounts you do not recognise.
- Follow Rank Math’s own security notice for its specific clean-up steps.
If you are not sure what plugins your site runs or who looks after it, that is worth sorting out regardless of this incident.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.