Who Is Stevie, and Why Should I Trust Him With My Website?
Two years ago I lost my own business to a hack I couldn’t see. What happened, what it taught me, and how a panicked client’s text message became my name.
The story · the hack and the name
Who Is Stevie, and Why Should I Trust Him With My Website?
You cannot tell by looking.
Two years ago I lost my own business to a hack I couldn’t see. What happened, what it taught me, and how a panicked client’s text message became my name.
Site actively down, redirecting, or serving pages you didn’t write? Call (754) 302-4631.
- Real name
- JacquesStevie is what a client called me
- Practice
- One person. Rescues, rebuilds and maintains small-business websites
- Experience
- Building websites since 1997
- sosstevie.com
- Registered May 2015
- My own site
- Taken over in 2024Found out from the silence, not an alert
The registration date is public and you’re welcome to check it.
The story
No alert, no ransom note, no defaced homepage.
The phone didn’t ring on a Tuesday. That happens. It didn’t ring much on the Wednesday either, and by the Friday I’d started telling myself it was the season.
It went on like that for a few weeks. Nothing dramatic. No alert, no ransom note, no defaced homepage with a flag on it. I opened my site every morning and it looked exactly the way it had always looked. Same pages, same photos, same everything. I had no reason to think anything was wrong except that the work had stopped arriving.
When I finally went looking properly — not at the site, at what Google thought the site was — I found tens of thousands of pages I had never written. Casinos. Pharmaceuticals. Mail-order brides. Someone had made himself primary administrator months earlier and quietly built an entire second website inside mine, invisible to me and perfectly visible to search engines.
I took the whole thing down. Not repaired — down.
And then I sat there and did the arithmetic on how long it had been running while I congratulated myself on how clean my homepage looked.
That is why nothing I sell is theoretical. Every service on this site exists because a version of it would have saved me.
Where the name came from
I have a French name. Jacques.
I have a French name. Jacques. In all my years of doing this in the States I’ve heard it pronounced correctly maybe half the time, and I stopped correcting people a long while ago.
One client never got near it. He’d try, give up, and land somewhere else entirely every time. Then one night his site went down — properly down, mid-campaign, the kind of down where you can hear him doing the arithmetic on what every hour is costing him — and he didn’t attempt my name at all.
The text just said:
SOS STEVIE.
I fixed his site. The name stuck — first as a joke between the two of us, then as what half his referrals called me, and eventually as the only thing anybody could remember. In May 2015 I registered sosstevie.com, because by then it was simply what people called me when something was on fire.
That’s the part I’d rather you noticed. I spent nine years trading under a name that promised emergency rescue before I became the emergency myself. The registration date is public and you’re welcome to check it. I didn’t build this brand after the disaster to explain the disaster — the name was already on the door when the disaster arrived, which is a considerably less comfortable thing to admit.
You cannot tell by looking
Your website has two audiences and you only ever see one of them.
This is the part I want anyone reading to take away, even if they never contact me.
You see the site your browser renders when you, a logged-in administrator on a familiar device, type your own domain.
Search engines see something assembled differently — different pages served to different visitors, redirects that only fire for traffic arriving from search, content that appears for a crawler and vanishes for you.
A competent attacker is not trying to break your website. He needs it up. He needs it fast, indexed, and trusted, because he’s borrowing the reputation you spent years building to rank pages he could never rank on a domain of his own. Breaking it would destroy the only thing he came for.
So the symptom isn’t a broken site. The symptom is silence. Enquiries thin out. Rankings for your actual services slide. Someone mentions they couldn’t find you and you assume they typed it wrong.
The cost of doing nothing here isn’t a repair bill. It’s every month of trading you lose before you notice, plus however long it takes to earn back the trust the domain lost while it was hosting somebody else’s casino.
Why it’s worse now
Why this is worse now than it was when it happened to me
Two things have moved, and neither has moved in your favour.
The number of ways in keeps climbing.
Patchstack’s State of WordPress Security in 2026 recorded 11,334 new vulnerabilities across the WordPress ecosystem during 2025 — a 42% increase on the previous year, with 91% of them found in plugins rather than in WordPress itself. Read that carefully, because it’s routinely misquoted: it counts holes discovered, not sites broken into. Most never touch you. What it tells you is where the risk concentrates — in third-party code you installed once and stopped thinking about.
Nobody finds these things quickly.
IBM’s Cost of a Data Breach Report 2025 puts the average breach lifecycle at 241 days — 181 to identify, 60 to contain — and that was the lowest figure in nine years. That’s enterprise data, from organisations with security teams and budgets, and I’m not going to pretend it maps cleanly onto a small business website. It doesn’t. But if companies with a security operations centre take six months to notice, the honest expectation for a small business with no monitoring at all is longer, not shorter.
That’s the gap I lost a business inside. Not a dramatic gap. A boring one, made of months.
The pattern
The Four Moves of a Silent Compromise
This is the shape of what happened to me, and of nearly every injection I’ve cleaned up since. It’s the same four moves almost every time.
The way in.
An outdated plugin, an abandoned theme, a reused password, or a stale administrator account belonging to a developer who left years ago. Rarely anything clever. Almost always something ordinary that nobody had looked at in a long time.
Persistence.
Before doing anything visible, the attacker makes sure he can get back in — a second admin user, a backdoor in a theme file, a scheduled task that recreates both if you delete them. This is why a surface clean-up so often “fails” a fortnight later. The pages come back because the door was never shut.
Publication.
Now the pages appear. Thousands, sometimes tens of thousands, usually served only to search engine crawlers and to visitors arriving from search results. Log in as yourself and the site is spotless. It is genuinely spotless — for you.
The slide.
Search engines re-evaluate what your domain is about. It’s now mostly about casinos. Your rankings for the thing you actually do decay, slowly enough that every individual week looks like normal variance. Then one day you realise the phone hasn’t rung properly since spring.
Do this yourself
Six things you can check yourself this afternoon
None of this needs me. If you do only these, you’re ahead of where I was.
If any of those turns up something you can’t explain, don’t start deleting. Deleting before you understand the persistence mechanism is how people spend the next month cleaning the same site four times.
What I do with it now
Looking fine is what a good compromise is for.
I don’t tell that story for sympathy. I tell it because it’s the reason the order of operations on this site is what it is, and because every owner I meet has the same reasonable and completely wrong instinct I had: my site looks fine, therefore my site is fine.
If you’ve read this far and something on the list above bothered you, the next step isn’t to hire me. It’s to run the six checks. If they come back clean, you’ve spent twenty minutes and bought yourself real peace of mind rather than assumed peace of mind.
If they don’t come back clean, or if you’d rather someone looked properly:
Site actively down, redirecting, or serving pages you didn’t write? Don’t book anything — call (754) 302-4631. That’s a different conversation and it starts now.
Keep reading