After the mesh is hunted, leftover doors can put the attacker back in. Public October 2026 reporting on SC 4.0.3 and Apex Logger (mdpabel, ProWebCare, Monarx, TopSyde) plus Sucuri auto-login JS backdoors (December 2025) describe plaintext password dumps, secret helper URLs, admin Service Workers, sibling-site walks, and fake file-manager AJAX.

Bedrock hunts those leftover doors. Stop skilled attacks also interrupts passwordless auth cookies when WordPress hooks still run, strips Service Worker registration on wp-login and wp-admin (known PWA plugins stay allowlisted), and can quarantine reachable helper PHP under wp-content.

After a password-capture or auto-login finding, rotate every administrator password and the WordPress salts. Unregister Service Workers on every admin device. Treat other sites under the same host user as dirty. If this is a store, rotate payment and gateway keys. Bedrock cannot wipe another browser from this server. It cannot see sibling sites outside open_basedir. It cannot stop every cookie minted before our hooks load. It is not bulletproof.

You never change DNS. Read the short note or Ask for a $199 cleanup.