Bald Rock Amateur Radio Club: Rescued From a Live Hack, Rebuilt Secure

Bald Rock Amateur Radio Club (N4BRC) is a 501(c)(3) nonprofit serving licensed hams, public-service volunteers, and curious beginners around Pell City and St. Clair County, Alabama. A routine security look-under-the-hood, done ahead of a planned redesign, turned up something nobody expected.

The challenge

The club's site ran on Joomla, a content management system it had used for years without any obvious problems. The audit turned up an active, ongoing compromise:

• Dozens of hidden backdoor files disguised as normal site files, some hidden inside image files, some tucked into a folder usually reserved for domain verification
• Server logs showing real attackers, from multiple locations, actively using one of those backdoors in the days before we found it
• File permissions loose enough that whoever planted it could keep coming back

None of this showed up from just browsing the site. It took a real security audit to find it — and a lot of nonprofits, churches, and small clubs are running exactly this kind of quietly-compromised site without knowing it.

What we did

Cleaning house, carefully

Before changing anything, we backed up the entire site for forensics, then worked through it methodically: every file was checked, every image individually verified, and every piece of real content — events, repeater info, net schedules, photos — was pulled out and preserved before the compromised software was removed entirely.

A rebuild with nothing left to hack

Rather than patch a CMS that had already been broken into once, we rebuilt the site from scratch as a fast, modern static site: no database, no CMS login, no plugins for an attacker to exploit. Every real feature the club relied on came with it:

• Live NWS weather radar and county alerts
• A real-time skycam feed
• Repeater frequencies and the weekly Tuesday net schedule
• Online donations

Ready for Google on day one

A freshly rebuilt site is invisible to search engines until it's told it's open for business. We built out a sitemap, page metadata, canonical URLs, and redirects from the old site's pages, then connected Google Analytics and Search Console so the club can see real traffic from day one.

The result

Bald Rock ARC now has a site that's faster, safer, and actually theirs — no compromised software quietly working against them in the background, and every real feature (weather, repeaters, the weekly net, the skycam) still there.

Visit the live site or tell us about your website.