Youth Theatre on the Fontanka

The public site of the State Youth Theatre on the Fontanka in St Petersburg, a repertory theatre in Izmailovsky Garden, playing to an audience that books on a phone. This was not a redesign engagement: the site arrived as an end-of-life WordPress install running pirated commercial plugins, with two working backdoors in it.

What we found

WordPress 5.5.17 on PHP 7.4, years past end of life, with edits made directly on the production server. The theme carried a link injector phoning home to a third-party domain, and a vendored plugin hid an admin-account creator behind a hardcoded password. xmlrpc.php was unused and under constant brute force, roughly 13 000 POST requests logged.

De-nulling

Every pirated component was replaced with a clean source rather than patched: ACF Pro gave way to Secure Custom Fields, the WordPress.org fork that reads the same field data through the same API, and Slider Revolution to a small in-house shim. Both backdoors were excised, the infected container stopped, and file modification disabled at the configuration level so nothing can be reintroduced through wp-admin.

Re-platform

The stack moved to WordPress 6.9 / PHP 8.2 / MySQL 8 in the dev environment first, then to production in a scheduled cutover. WordPress core no longer lives in the repository: it is pinned and baked into a Docker image, so the running container is read-only and every change, plugin updates included, goes through git.

Delivery pipeline

Single-branch GitLab CI/CD: a push to main deploys to dev automatically, and production is a one-click promotion of the same image. A Traefik v3 edge terminates TLS through Let’s Encrypt for both environments, which run as isolated Docker stacks against a shared MySQL. A reconcile step runs after every deploy and every reseed, because the database carries state the image cannot.

Scale

The CMS is maintained by non-technical, Russian-speaking editors and holds 2 869 showings, 146 productions, 93 artists, 101 creators and 880 news posts across roughly 1 455 attachments. Ticketing runs through the Билетёр provider, embedded under the theatre’s own header.

Key Highlights

• Two live backdoors removed: a theme link injector and a hardcoded-password admin creator
• Nulled plugins replaced, not patched: clean open-source equivalents on the same APIs
• 5.5.17 on PHP 7.4 to 6.9 on PHP 8.2: rehearsed in dev, then a scheduled production cutover
• Immutable deploys: core baked into the image, read-only container, no editing on the server
• One-click production: dev deploys on every push, prod promotes the identical image
• xmlrpc.php closed: an unused endpoint absorbing a constant brute-force load
• Hosted on Russian infrastructure: a legal requirement for personal data, not a preference