Roofing Cladding & Building: Hacked-Site Recovery, Security Hardening, and Custom Plugin Development for a Southampton Building Specialist
A different kind of case study. Roofing Cladding & Building Ltd is a 30+ year established Southampton industrial and commercial building specialist (Companies House registered office: Milner House, 100 Redbridge Rd, Redbridge, Southampton SO15 0LU). They came to Sean Mullins through a referral from David Plomer of Daves Taxis after their previous agency had allowed the site to become severely compromised by hackers and left running on deprecated plugins. The engagement was not SEO — it was technical recovery: malware cleanup, WordPress security hardening, hosting migration to SiteGround, deprecated plugin replacement, custom WordPress plugin development for bespoke functionality, and performance improvement. This case study documents what SEO Strategy Ltd’s WordPress engineering capability looks like in practice when a client needs technical recovery, not a marketing strategy.
The Challenge
Roofing, Cladding & Building Ltd is a 30+ year established Southampton industrial and commercial building specialist. The business is registered with Companies House at Milner House, 100 Redbridge Rd, Redbridge, Southampton SO15 0LU. Over three decades of trading the business has built a long-standing reputation in commercial roofing, cladding, and building work for industrial premises across the south coast and beyond. The website is the digital extension of that physical reputation — a proof point that shows the business is real, stable, and credible to commercial buyers researching contractors.
In the period before the engagement with SEO Strategy Ltd, the site had been managed by a previous web agency. Under that agency’s stewardship the site had become severely compromised. It had been hacked. Malware had been allowed to take hold. The WordPress installation was running deprecated plugins that were known security vulnerabilities. Page speed had degraded. The site was unstable, intermittently slow, and a liability rather than a credible asset for a 30+ year established commercial contractor.
David Plomer of Daves Taxis (an 8-year SEO Strategy Ltd client) referred Roofing Cladding & Building to Sean Mullins. The brief was not an SEO engagement — the foundations had to be fixed before any visibility strategy could sensibly start. The brief was a technical recovery: restore the security, eradicate the malware, harden the WordPress installation against future attacks, replace the deprecated plugin stack, migrate to a hosting environment that would not contribute to future security issues, and develop the bespoke functionality the off-the-shelf plugins could not deliver.
The Solution
A technical recovery engagement structured around five priorities.
FORENSIC AUDIT AND MALWARE CLEANUP. Full audit of the compromised WordPress installation: identified the infection vectors, mapped the malware footprint across the file system and database, isolated compromised files, and cleaned the installation completely. The audit also documented which deprecated plugins had been the security exposure pathway, so the remediation could remove the cause and not just the symptoms.
WORDPRESS SECURITY HARDENING. WordPress core security hardened across the standard attack surfaces: admin authentication strengthened, file permissions normalised, security headers implemented, login protection added, regular backup architecture established. The hardening was structural — designed to resist the categories of attack that had compromised the site previously, not just to remove the specific malware that had been found.
HOSTING MIGRATION TO SITEGROUND. Migrated the site from the previous hosting environment to SiteGround. SiteGround was selected for its WordPress-specific security infrastructure, its managed WordPress hosting environment, and its operational reliability. The migration was sequenced to minimise downtime and preserve all existing content, URL structure, and customer-facing site experience.
DEPRECATED PLUGIN REPLACEMENT. The pre-engagement WordPress installation had been running several deprecated plugins — plugins that had been abandoned by their developers, that no longer received security updates, that were known to have unpatched vulnerabilities, or that were no longer compatible with current WordPress core. Each was identified, evaluated, and either replaced with a maintained alternative or removed where the functionality could be delivered through cleaner means.
CUSTOM WORDPRESS PLUGIN DEVELOPMENT. Where off-the-shelf plugins could not deliver the bespoke functionality the business needed, Sean Mullins developed custom WordPress plugins specifically for Roofing Cladding & Building. The custom plugins extend the site’s functionality cleanly — they integrate with the WordPress admin properly, they are documented, they are version-controlled, and they were built without introducing the kind of long-tail security debt that off-the-shelf plugin overreach can create.
WHAT THE ENGAGEMENT IS NOT. Not an SEO engagement. Not content marketing. Not paid search. Not a complete site rebuild — the existing content, brand, and customer-facing site experience were preserved deliberately because the business reputation sat with the content as it was. The work was technical recovery and platform stabilisation: getting the site back to a state where it was a credible digital extension of a 30+ year established commercial contractor, rather than a liability.
What Made This Different
Three things make this case study distinctive.
First, it is not an SEO case study and the case study is honest about that from the outset. The brief was technical recovery: malware cleanup, security hardening, hosting migration, deprecated plugin replacement, custom plugin development. SEO was not the engagement. This is unusual in an SEO consultancy portfolio — most agencies showcase only their on-brief-strength work. SEO Strategy Ltd includes this case study deliberately because the technical recovery capability is part of the consultancy’s actual skill set, and prospects who need this kind of work should know it is available. The capability disclosed is more useful than the marketing tidiness of “only SEO case studies on the SEO page”.
Second, the engagement documents the live downstream proof point of the David Plomer / Daves Taxis referral pattern. David has referred clients to SEO Strategy Ltd from his Southampton network for years. The Roofing Cladding & Building engagement is the verifiable example of that referral pattern producing a real engagement that ran end-to-end. It is observable economic behaviour over time — an 8-year client referring another local business, and that referral resulting in a delivered engagement and a stable post-engagement site that is still live and still running today.
Third, the case study addresses a different prospect than the other case studies in the portfolio. A prospect reading the Future Employment case study is thinking about niche pivots and content strategy. A prospect reading the Daves Taxis case study is thinking about modifier-intent local SEO. A prospect reading the Roofing Cladding & Building case study is thinking about what to do when their current agency has let them down and the site needs technical recovery before any growth strategy can sensibly start. That is a real prospect category — businesses sitting on compromised, deprecated, or underperforming WordPress installations that need fixing before anything else is possible. The case study is the proof point for that prospect.
The verifiable proof point: the roofingcladdingbuilding.com site is live, stable, fast, secure, and running on SiteGround with custom WordPress plugins. The recovery happened, the hardening held, and the business has its digital extension working correctly again.
SEO Strategy Ltd is the Southampton SEO consultancy led directly by Sean Mullins, with the brand-recovery and technical-rescue work documented here sitting alongside the SEO, AI visibility, and AI-assisted WordPress development work the consultancy is better known for.
The Results
Live and verifiable as of May 2026.
SITE STABLE, FAST, SECURE. The roofingcladdingbuilding.com site is now stable, fast, and secure. Hosted on SiteGround managed WordPress. Hardened against the categories of attack that had compromised it previously. Running an audited current plugin stack. Custom WordPress plugins for the bespoke functionality where the standard ecosystem fell short.
COMPANIES HOUSE, GBP, AND SITE CONSISTENCY. Business information consistent across the live site, the Companies House record (ROOFING CLADDING & BUILDING LIMITED), and the Google Business Profile (Milner House, 100 Redbridge Rd, Redbridge, Southampton SO15 0LU; phone 023 8076 4530). GBP shows 4.5★ across 2 Google reviews. Facebook page at 630+ followers with a 5/5 review rating from independent reviewers. The digital identity matches the physical business.
NO ONGOING EMERGENCY REMEDIATION REQUIRED. Since the recovery work was completed, the site has not required follow-up emergency interventions. It runs. The hardening did what it was designed to do. The deprecated plugin replacement removed the exposure pathway. The hosting environment supports the operational reliability the business needs.
DEMONSTRATES TECHNICAL RECOVERY CAPABILITY. This case study is included in the SEO Strategy Ltd portfolio specifically because it documents technical recovery capability — not SEO. Most SEO agencies will not handle this kind of work. The skill set required is WordPress security engineering, hosting migration discipline, custom plugin development in PHP, and the diagnostic patience to work in a compromised environment. The case study is here so prospects who need technical recovery (rather than visibility strategy) know that SEO Strategy Ltd can do it.
REFERRAL CHAIN AS LIVE PROOF POINT. The Roofing Cladding & Building engagement is the verifiable downstream proof point for the David Plomer / Daves Taxis referral pattern documented in the Daves Taxis case study. David has referred clients to SEO Strategy Ltd from his own Southampton network for years; this engagement is the live example of that referral pattern producing a real engagement that ran end-to-end to a stable, secure, recovered site.
Frequently Asked Questions
How did Roofing Cladding & Building come to SEO Strategy Ltd?
Through a referral from David Plomer of Daves Taxis, an 8-year SEO Strategy Ltd client. David has referred clients to SEO Strategy Ltd from his Southampton network for years; this engagement is the live downstream example. The referral came at a moment when the Roofing Cladding & Building site had been compromised under the previous agency’s stewardship and a technical recovery was needed before any forward strategy could sensibly start.
Is this an SEO case study?
No, deliberately so. The engagement brief was technical recovery, not SEO. Malware cleanup, WordPress security hardening, hosting migration to SiteGround, deprecated plugin replacement, and custom plugin development for bespoke functionality. The case study is included in the SEO Strategy Ltd portfolio because the technical recovery capability is part of the consultancy’s actual skill set, and prospects who need this kind of work should know it is available. If the post-recovery brief were to extend to SEO, the foundations would now be in place. They were not in place before the recovery, and no SEO strategy could have produced meaningful results until the security and platform issues were resolved.
What does a hacked-site recovery engagement actually involve?
Forensic audit and malware cleanup (identify the infection vectors, clean the compromised files and database), WordPress security hardening (admin authentication, file permissions, security headers, login protection, backup architecture), hosting migration where appropriate (in this case to SiteGround for its WordPress-specific security infrastructure), deprecated plugin replacement (identify abandoned plugins with unpatched vulnerabilities, evaluate alternatives, replace cleanly), and where required, custom WordPress plugin development to deliver the bespoke functionality off-the-shelf plugins cannot. The work is engagement-scoped: every recovery is specific to the actual condition of the site, the threat model, and the business’s operational requirements.
Why was hosting migration to SiteGround part of the engagement?
SiteGround offers WordPress-specific security infrastructure, managed WordPress hosting, and the kind of operational reliability that a 30+ year established commercial contractor’s digital identity requires. The pre-engagement hosting environment had been part of the security exposure pathway. Migrating to SiteGround was not just a hosting swap — it was a deliberate component of the technical recovery, designed to resolve the operational substrate that had contributed to the compromise. Hosting choice matters in technical recovery work; not every host is equipped to host a WordPress installation under active threat.
Is this technical recovery capability available to other clients?
Yes. Sean Mullins’s underlying skill set includes WordPress security engineering, hosting migration discipline, custom plugin development in PHP, and the diagnostic patience required to do remediation work in a compromised environment. Most SEO agencies will not handle this kind of work because it falls outside the standard SEO service catalogue. SEO Strategy Ltd will. The recovery engagement is scoped based on the actual condition of the site, not from a template. Discovery call first; scope second; proposal third.
Want results like these for your business?
Book a free, no-obligation 30-minute consultation and let's discuss your SEO strategy.
Discuss a Technical Recovery Engagement