Where developers grow together

WordPress Security Incident Response and Website Recovery

Project Overview This repository documents a sanitized WordPress security incident response and recovery project completed for a client whose website had been compromised. The project involved investigating the security issue, identifying suspicious files and unauthorized changes, restoring website functionality, removing malicious components, strengthening the WordPress installation, and implementing preventive security measures. Confidentiality Notice: All client-identifying information, credentials, private URLs, database records, sensitive logs, and malicious files have been excluded. This repository documents the recovery methodology and lessons learned only. My Role WordPress Developer and Security Consultant Project Objectives Investigate signs of website compromise Identify suspicious files and unauthorized modifications Restore the website from a verified clean source or backup Remove malicious or unauthorized components Secure WordPress core, themes, plugins, and user accounts Reduce the risk of reinfection Verify website functionality after recovery Establish ongoing security and backup practices Recovery Workflow 1. Initial Assessment Reviewed the reported symptoms Checked website availability and visible changes Identified potentially affected WordPress components Documented the initial condition Preserved available backups and evidence before making changes 2. Containment Restricted unnecessary administrative access Reset relevant credentials Reviewed WordPress user accounts Removed unauthorized access where confirmed Prevented further changes during the recovery process 3. Investigation Reviewed WordPress core files Checked themes and plugins for unauthorized modifications Investigated suspicious files and unexpected code Reviewed file permissions and server configuration Checked for unknown administrator accounts Reviewed available security and server logs 4. Recovery Restored verified clean website files and data where appropriate Reinstalled WordPress core from a trusted source Replaced compromised or modified components Removed unnecessary themes and plugins Updated supported software components Verified website functionality 5. Security Hardening Enabled strong authentication practices Applied least-privilege access controls Reviewed administrator accounts Strengthened login protection Configured firewall and security monitoring Improved file and directory permissions Disabled unnecessary functionality Configured automated backups Applied regular update and maintenance procedures 6. Validation Tested website pages and key functionality Checked forms, login, media, and administrative workflows Performed a follow-up security scan Reviewed website performance and error logs Confirmed that no known indicators of compromise remained Tools and Technologies Penetration (Cross Server Penetration/Migration/Phishing) Vulnerability scanning Vulnerability exploitation WordPress Security Scanner Server/File Manager or SFTP phpMyAdmin Malware and integrity scanning tools Web Application Firewall Backup and restoration tools Outcome The website was restored to normal operation (only 50% of data could be recovered), compromised or unauthorized components were addressed, and additional security controls were implemented to reduce the risk of future incidents. Verified results: Website functionality restored Unauthorized or suspicious components addressed WordPress core, themes, and plugins reviewed and updated User access reviewed and secured Backup and security monitoring processes established Key Lessons Maintain tested, off-site backups Keep WordPress core, themes, and plugins updated Remove unused plugins and themes Use strong authentication and least-privilege access Monitor file changes and security alerts Treat website recovery as both a restoration and hardening process

Med-Intel : AI-Powered National Health Intelligence & Rural OPD Management System

Overview MED-INTEL is an enterprise-grade, privacy-first healthcare intelligence platform designed for district-level public health administration, rural healthcare facilities, doctors, and patients. It provides real-time syndromic surveillance, intelligent OPD ticket booking with automated AI symptom classification, digital lab record access, AI clinical assistance for doctors, and automated pharmaceutical supply chain dispatching to prevent stockouts of life-saving medicines across primary health centers (PHCs). 🛡️ Hardware TEE Enclave & Privacy Guarantee Medical records and AI symptom prompts are processed within hardware-isolated Trusted Execution Environments (TEE) (AMD SEV-SNP / Intel SGX). Host operating systems and hypervisors cannot inspect unencrypted memory. Data access strictly enforces ABHA ID / Mobile Number zero-knowledge binding, ensuring ABDM & DISHA compliance. 🏗️ System Architecture +-------------------------------------------------+ | USER CLIENTS | | (Mobile Web / Desktop Browsers / Kiosks) | +------------------------+------------------------+ | HTTPS / WSS (TLS 1.3) | v +-------------------------------------------------------------------------------------------------------------------+ | MED-INTEL REVERSE PROXY | | (Port 3000 Ingress Routing) | +-------------------------------------------------------------------------------------------------------------------+ | v +-------------------------------------------------------------------------------------------------------------------+ | NODE.JS EXPRESS FULL-STACK SERVER | | | | +--------------------------------+ +---------------------------------+ +----------------------------------+ | | | PATIENT & OPD ENGINE | | DOCTOR CLINICAL SUITE | | DISTRICT COMMAND CENTER | | | | - ABHA / Phone Auth | | - Real-time OPD Queue | | - AI Supply Chain Dispatch | | | | - Multilingual AI Triage | | - Digital RX Generator | | - Bed Capacity Monitor | | | | - Digital Lab Report Viewer | | - Geofenced WiFi Attendance | | - D3.js Outbreak Heatmaps | | | +--------------------------------+ +---------------------------------+ +----------------------------------+ | | | | +----------------------------------------------------------|--------------------------------------------------------+ | v +-------------------------------------------------------------------------------------------------------------------+ | TRUSTED EXECUTION ENVIRONMENT (TEE) ENCLAVE | | (Hardware Isolated Memory - AMD SEV-SNP) | | | | +-------------------------------------------------------------------------------------------------------------+ | | | 🔐 CONFIDENTIAL COMPUTING LAYER | | | | - AES-256-GCM / RSA-4096 Data Encryption At-Rest & In-Flight | | | | - Google Gemini 2.5 Flash Server Proxy (Zero-Knowledge AI Prompt Enclave) | | | | - Attestation Token Verification (Hardware Cryptographic Proofs) | | | +-------------------------------------------------------------------------------------------------------------+ | | | +-------------------------------------------------------------------------------------------------------------------+ | v +-------------------------------------------------------------------------------------------------------------------+ | DATA PERSISTENCE & ANALYTICS LAYER | | | | +----------------------------------+ +----------------------------------+ +---------------------------------+ | | | IN-MEMORY / FIRESTORE | | OFFLINE LOCALSTORAGE CACHE | | NFHS-5 CENSUS INDICATORS | | | | Dynamic Patient & Inventory DB | | Resilient Offline OPD Sync | | Epidemiological Calibration | | | +----------------------------------+ +----------------------------------+ +---------------------------------+ | | | +-------------------------------------------------------------------------------------------------------------------+   ✨ Key Features 1. 👤 Patient Portal & ABDM Integration ABHA / Mobile Auth: Frictionless login bound to the patient's registered mobile number or 14-digit ABHA Health ID. Smart AI Triage & OPD Booking: Instant symptom analysis in English, Hindi, and regional languages automatically assigning patients to the right medical department. Digital Health Locker & Lab Reports: View official laboratory test reports (CBC, Dengue NS1, Electrolytes, Ultrasound) and download official ABHA-verified PDFs. Digital Prescriptions: View active medication routines, dosages, and doctor notes. 2. 🩺 Doctor Clinical Dashboard Queue Management: Real-time patient OPD token system with urgency categorization (Red, Yellow, Green). AI Clinical Summarizer: Automated symptom analysis and diagnostic suggestion engine powered by Gemini 2.5 Flash. Digital Rx Generator: One-click prescription builder pre-linked with hospital medicine stock. Geo-fenced WiFi Attendance: Automated doctor duty verification matching facility BSSIDs/SSIDs. 3. 🏛️ District Admin Command & Supply Chain Hub AI Medicine Supply Dispatch: Predictive inventory monitoring that automatically generates transfer requests from District Drug Warehouses to rural PHCs before medicine stocks deplete. Critical Bed Occupancy Tracking: Real-time departmental bed capacity alerts (ICU, Emergency, Maternity, General). D3.js Syndromic Outbreak Heatmap: Visual geospatial cluster mapping detecting localized infectious outbreaks (Dengue, Malaria, Gastroenteritis). Official Public Health Indicators: Calibrated with Census and NFHS-5 data for epidemiological accuracy. 🛠️ Tech Stack Frontend: React 18, Vite, TypeScript, Tailwind CSS, Lucide Icons, Motion Animation Library, D3.js. Backend: Node.js, Express, TypeScript (tsx in dev, esbuild for CJS production bundling). AI Engine: Google @google/genai (Gemini 2.5 Flash) server-side proxy. Security Protocols: Trusted Execution Environment (TEE), AES-256-GCM, ABDM ABHA zero-knowledge data binding. 🚀 Getting Started Prerequisites Node.js: v18.0.0 or higher npm: v9.0.0 or higher Installation & Local Setup Clone the Repository git clone https://github.com/your-username/med-intel.git cd med-intel   Install Dependencies npm install   Set Up Environment Variables Create a .env file or export your Gemini API key: GEMINI_API_KEY=your_gemini_api_key_here   Start Development Server npm run dev   Access the app at http://localhost:3000. Production Build npm run build npm start   🔒 Security & Privacy Standard Compliance ABDM (Ayushman Bharat Digital Mission): Compatible with ABHA health card standards. DISHA (Digital Information Security in Healthcare Act): Strict patient data ownership and privacy. HIPAA Compliance Guidelines: Enclave-isolated storage and encrypted data transmission. 📄 License Distributed under the MIT License. 

KernelPulse

KernelPulse reimagines Linux server monitoring for people who don't want to run a monitoring stack just to monitor a server. Its purpose is to strip away the operational weight of Prometheus, exporters, Grafana, and a separate database, and replace all of it with one Python process that reads the kernel directly and ships with real intelligence built in — not bolted on. The goal isn't just visibility, it's judgment. Most lightweight dashboards show you numbers and leave the interpretation to you; most tools that do interpret the numbers require standing up real infrastructure to get there. KernelPulse closes that gap with a transparent AI layer — a z-score anomaly classifier, a slow memory-leak detector that catches growth patterns z-score alone would miss, and a capacity-exhaustion forecaster that tells you "RAM full in ~2h 14m" instead of just "RAM: 87%." Every one of those calls is explainable: the dashboard shows the raw value, the moving average, and the exact statistical threshold behind each status, so nothing is a black box. Ultimately, KernelPulse is built for the developer, student, or small team running a personal server or home lab who wants Prometheus-grade insight without Prometheus-grade overhead — a monitoring tool that installs in one command and actually tells you when something needs your attention, not just what the numbers are.